Or just stuff them into the DNS in the form of SSHFP records, where the OpenSSH client will read it from.

This assumes authenticated DNS data, of course. Not at all a given today, sadly.