So really the trend I'm talking about here is people turning SSH into a browser, hosting apps behind SSH that expect a much higher volume of TOFU happening, which is a departure from the "first time i setup my vps" kind of case.

Honestly at this point I'd be kind of happy if we could just use an x.509 cert from a webpki acme provider in the sshd and be done with it, for the host identity part.