There's a patch for openssh to use the ldns library and do its own DNSsec validation. A few distros apply it to their packages, though I'm not sure what the current status is. It never got accepted into openssh sadly.