3 ms·

Known_hosts can also be put in DNSSEC, using the SSHFP DNS record. OpenSSH understands that out of the box.