Recall not that long ago that the default DH group in SSH may have been defeated by NSA or someone similar. So now, during key agreement in SSH, the server and

Recall not that long ago that the default DH group in SSH may have been defeated by NSA or someone similar. So now, during key agreement in SSH, the server and the client agree on the DH group that they will proceed to use, and I believe that the server provides the group. If the client trusts the server without verifying the DH modulus is appropriate (of the form 2p + 1 with p prime), then a malicious server could weaken the connection by providing one of these weaker composite numbers.