SSH gets protection against side-channel attacks
I've looked at it. There's still a spectre window of opportunity to get the shielded private host keys.sshkey_shield_private => explicit_bzero() 
openbsd-compat/freezero.chttps://github.com/openssh/openssh-portable/commit/4f7a56d5e...It's only using the insecure freezero, which is using the insecure explicit_bzero. A simple compiler barrier only, no memory barrier. so it's unsafe against the advertised spectre/meltdown sidechannel attacks, the secrets are still in the caches.