@graslander at first, I thought you wrote about setting up a PKI on OpenBSD
As you use keys to authenticate clients, you still rely on TOFU when connecting to the server, you have two solutions to solve this:
- use SSH certificates to authenticate both clients and servers
- use SSHFP DNS entries
I covered the second system if you are interested https://dataswamp.org/~solene/2023-08-05-sshfp-dns-entries.html