This is a great idea. Right now my team has an onboarding script we maintain in a Git repo and we prepopulate a separate known_hosts file with our validated ke

This is a great idea. Right now my team has an onboarding script we maintain in a Git repo and we prepopulate a separate known_hosts file with our validated keys, but from that point forward each person maintains it themselves. It'd be nice to see some automation around SSH key validation. For instance, if from Keybase we could publish our SSH public key and additionally have some sort of facility to integrate with OpenSSH locally so we can use the NACL functions to maintain a signed/verified copy of a known_hosts file locally. The known_hosts file is kind of a weak point for SSH security when using public key auth, and I'd love to see something external that can improve upon this.