Hacker News Reader

You’re thinking of known_hosts, not authorized_keys.

You are right, I am. Now I understand the DNSSEC setup.

Known_hosts can also be put in DNSSEC, using the SSHFP DNS record. OpenSSH understands that out of the box.