I wrote up a little demo and explainer at
https://mitm.terminal.shop.rag.pub
ssh mitm.terminal.shop.rag.pubThey give you the ed25519 host key to insert into your known_hosts file on their homepage, which itself is served over TLS with all of the protections you describe in your article. They could go into more detail on being careful with not falling into the tofu trap perhaps, but I don't see that there's an inherent PCI-critical problem here. ssh tells you who, cryptographically, you're connecting to.
If I mess with my DNS and point it at your "little demo", this happens:
$ ssh foo@terminal.shop
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
And guess what? My browser lets me bypass HTTPS warnings too! Yes, even when HSTS is enabled I can take steps to bypass the warning.
Users will fall into the TOFU trap, most users who've sent them cash certainly did.
Most users won't put their credit card credentials into a page that they've had to bypass a cert warning on.
That shots from my parents balcony in Bermuda