[_bernd]

You can also sign ssh host keys with an ssh ca.

See ssh_config and ssh-keygen man-pages...