From what I can gather, ssh host key verification is just a way of doing pre-shared key authentication (of the server) that is easy to bypass (by design) in cas

From what I can gather, ssh host key verification is just a way of doing pre-shared key authentication (of the server) that is easy to bypass (by design) in case you decide you don't care. In an ideal world everyone everywhere has a side-channel through which they can affirmatively correlate host keys, for example getting a new VM in azure would tell you its host key fingerprint along with login details. in the real world nobody does check, but if you really wanted to or if your application is sensitive enough, you can, and without having to enable an option/use a different binary/etc. Recently I redeployed one of my VMs and the host key was regenerated, and it turns out ssh straight up tells you how to invalidate the host key cache. It has big bold warnings of course but we all know how that works.