I'd probably have hooks in deployment to publish SSH keys in the DNS. See https://en.wikipedia.org/wiki/SSHFP_record https://en.wikipedia.org/wiki/SSHFP_record

I'd probably have hooks in deployment to publish SSH keys in the DNS. See https://en.wikipedia.org/wiki/SSHFP_record https://en.wikipedia.org/wiki/SSHFP_record and https://man.openbsd.org/ssh_config.5#VerifyHostKeyDNS https://man.openbsd.org/ssh_config.5#VerifyHostKeyDNS I was trying to work on a script (like https://acme.sh https://acme.sh) to publish that kind of info, but DNS is hard, and I didn't have enough time to really work on that project.