That is my main objection as well, but perhaps it's time to also revisit TOFU.

Remember when Github had to rotate its host keys? It was hitting the news far and wide, and likely broke pretty close to every single CI pipeline out there. There was little heads up because it's the friggin host key, you have to act now.

It's also pretty annoying when you have to deal with that in your own infra. Even if you have a pretty good network/service map, you'll probably have silent breakage somewhere.

I'm not saying CAs should be the future of SSH, but TOFU is certainly a problem at scale.