<i>SSH gets this right</i><p>No, it doesn&#x27;t.<p>When was the last time you verified a host key out of band?<p>And if you&#x27;re using SSH, you know well enough to know why you should do the damn legwork to verify the key.  What do you expect for end users?<p>Furthermore, if nobody is doing out of band verification on the first pass, how do you expect users to distinguish between an attack and legit host key change?