The idea would be to enable you to verify the public key of a server to which you are connecting for the first time. RFC 4255 outlines this use case: http://to

The idea would be to enable you to verify the public key of a server to which you are connecting for the first time. RFC 4255 outlines this use case: http://tools.ietf.org/html/rfc4255 http://tools.ietf.org/html/rfc4255 When you first connect and get the SSH fingerprint, how many people truly validate through some other mechanism that this is the correct public key to use for some system? (I have on some systems but I know I have just accepted the public key on other systems.) The idea is to use DNSSEC and the SSHFP record to provide a mechanism to validate the SSH public key. Do note this is not a new idea. This RFC was published back in 2006.