Tested quickly, doesn't look like it. Host key checking happens before the roaming stuff. That doesn't mean it's limited to hostile honeypots, if it turns out

Tested quickly, doesn't look like it. Host key checking happens before the roaming stuff. That doesn't mean it's limited to hostile honeypots, if it turns out that this is easily exploitable it'll be a complete shitstorm with sysadmins getting owned left and right with rootkits implementing automatic exploitation.