For hostkeys on DO you can probably get a script to run that'll request a signed certificate from a server you own. The signed cert can be validated fully by cl

For hostkeys on DO you can probably get a script to run that'll request a signed certificate from a server you own. The signed cert can be validated fully by clients. Or go with a convergence style system and probe it from multiple locations. Or just give up and go with TOFU - if you never get an error even on different connections, you probably haven't been mitm'd.