Unused private key material shouldn't just by lying around. It's better to generate it just in time, when migrating key material is needed, and use an authorit

Unused private key material shouldn't just by lying around. It's better to generate it just in time, when migrating key material is needed, and use an authoritative method to distribute known hosts (Krb5, cfg mgmt). OpenSSH supports sahfp DNS records (RFC4255), but DNS often lacks end-to-end integrity. So that leaves cfg mgmt and directories like LDAP & Krb5. (PS: if a box is compromised, don't just change host keys, rebuild it (patched) on a private network... It's too expensive and nearly impossible to prove a compromised box isn't still rooted, undoing bandaids and creating more work. (Find out cause if possible and rachet up defenses too.) The avg rootkits these days are crazy modular and far more devious than even 5 years ago.) If this adds an ability to add N keys, this could be useful for core boxes that you don't want to introduce cyclic dependencies upon other infrastructure (the cycles aren't always obvious). Be aware that some boxes and services shouldn't depend on "ubiquitous" services like DHCP or DNS being alive, if you want your on-prem / datacenter network gear, BGP, security system, etc. to survive interruptions.