> Each new key issued by the server could be signed by the previous (already trusted) key That doesn't work if the host's private key is leaked, or may have be

> Each new key issued by the server could be signed by the previous (already trusted) key That doesn't work if the host's private key is leaked, or may have been leaked, e.g. [0][1]. The current solution seems ok; we go through another channel to confirm the new key, likely either receiving an email about the key change, or using the web. [0] https://github.blog/news-insights/company-news/we-updated-our-rsa-ssh-host-key/ https://github.blog/news-insights/company-news/we-updated-ou... [1] https://bitbucket.org/blog/ssh-host-key-changes https://bitbucket.org/blog/ssh-host-key-changes