Well, I didn't look through every line of the patch, but my understanding is that once the server stops using key A, it'll automatically be revoked / deleted fr

Well, I didn't look through every line of the patch, but my understanding is that once the server stops using key A, it'll automatically be revoked / deleted from the client. Why else would http://bxr.su/o/usr.bin/ssh/hostfile.c#hostfile_replace_entries http://bxr.su/o/usr.bin/ssh/hostfile.c#hostfile_replace_entr... be calling hostkeys_foreach() function with the pointer to host_delete() as the parameter? E.g. revoking the key is as easy for the server as simply no longer using it. Which is why I'm saying it's a race condition -- if the attacker comes first, it would appear that they're free to revoke every single valid key for the server, replacing all such keys with whatever keys they wish.