I just happened across something nifty: you can use the VerifyHostKeyDNS option in your SSH configuration to fetch the host’s public key fingerprint over DNSSEC-secured DNS (with a “SSHFP” record type).

This is defined in RFC 4255, Using DNS to Securely Publish Secure Shell (SSH) Key Fingerprints if you’re looking for some light reading.

Related posts:

1. iPhone 4 Antenna
2. The trouble with SPF
3. SPF
4. More on Spam Filtering
5. Mastering your tools