Sort of. What i'm proposing is a combination of CHAP based on mutual secrets and the host IP and key checks SSH does, and after that PKI. (Though SSH doesn't record the IP address of the destination unless you explicitly use the IP, so the DNS address can still be spoofed)