I am...not a fan of Golang, as I have made pretty clear around here on occasion. But I'll give credit where credit's due, and this is a good decision on the part of the people maintaining x/crypto/ssh. Not the tooling vendor's awful response--I'm pretty sure I know who it is, and if not there's two of 'em because I've had these conversations before--but the maintainers are doing the right thing. This probably shouldn't have gotten out the door without host key verification in the first place (and that ties back into the reasons why I do not like or trust Golang or its community when it comes to tools that I have to consume), but it's better to bite the bullet and fix this now instead of letting it fester.

(The "PGP is too hard for discussing security issues" thing, though, is total nonsense. Can't be doing that.)