Another problem with SSH is that people remove the key check completly in automations since some services just rotates the keys without telling. Or for being lazy.
That's also solved with host CA. You can rotate the host keys, add new machines/keys however you want, and all that matters is whether the host keys are signed with a trusted CA, when you setup automation to trust that CA.
