Host-key rotation in OpenSSH 6.8

A client can verify new Host keys, and a server can verify new user keys, all by checking if it's signed or revoked by the CA. This prevents a client from receiving a host key generated by an attacker on a compromised host, and it allows a server to authenticate clients even if they've never received the client user's key.

If this functionality is used properly, it should be more secure than the new feature mentioned above. The only advantage the new feature has is it'll work with clients that support the new feature without having to modify their configuration (but it still doesn't provide all the features or security the CA provides).