ssh is, by default, Trust on First Use which is a significantly different model than a Trusted Thirdparty (CAs).

There are some well known trade-offs, namely that having everyone manually verify fingerprints on initial connect and again on any server change is a large burden.

I don't particularly want to have to go into my bank's local office and verify in person the fingerprint is correct each time they need to rotate a secret.

If this isn't what you meant, that we should use TOFU vs Trusted third party, please do expand.