There is an SSHFP DNS record for this purpose, which should be just as secure with DNSSEC enabled.

https://en.wikipedia.org/wiki/SSHFP_record