However, see-also DNSSEC and http://benctechnicalblog.blogspot.com/2011/03/sshfp-dns.html

Though I guess DNSSEC puts you back at PKI ...