Well, I'd rather run something I know has limited security (eg rsh+/etc/hosts-allow over a closed vpn) than ssh without key verification - because then you thro

Well, I'd rather run something I know has limited security (eg rsh+/etc/hosts-allow over a closed vpn) than ssh without key verification - because then you throw out trust, and encryption without trust buys you very little. Or kerberized rsh/telnet. As for port forwarding, if you trust the network, presumably you don't need forwarding? And for file transfer just use zmodem, or run rsync/ftp? (remember: you trust the network..). I will admit that there's a minor convenience to be able to use one client/api/interface - but I'm not sure it's worth the tradeoff of suddenly not knowing if you should be trusting ssh to be actually secure, rather than just convenient. Clearly the maintainers of the go package feel the same way (after some gentle prodding).