For hostkeys on DO you can probably get a script to run that'll request a signed certificate from a server you own. The signed cert can be validated fully by clients.

Or go with a convergence style system and probe it from multiple locations.

Or just give up and go with TOFU - if you never get an error even on different connections, you probably haven't been mitm'd.