That's what SSHFP records are for. You store the fingerprint of the SSH server in DNS and then turn on a setting in your ~/.ssh/config and it will check for you

That's what SSHFP records are for. You store the fingerprint of the SSH server in DNS and then turn on a setting in your ~/.ssh/config and it will check for you if it matches with DNS when you try to connect. Even without DNSSEC it creates another thing which needs to be spoofed.