Alternate solutions I'm aware of would be SSH certificates and querying LDAP. One of the issues with SSH certificates (AFAIK) is that they become rather cumbersome when administrative domains aren't cleanly separated, which is quite common once you're outside rigid and obvious organizational structures that reflect into sysadmin. LDAP has the same scoping issues, except even worse.
> You don't need any third-party PKI to get optimal SSH security!
This is a very binary view on an issue that is all about grimey, squishy user behavior. Sure, if users copy around SSH fingerprints, they don't need this. And either way they don't need it very often. But have you met users? The Web PKI goes to great lengths to avoid people shooting themselves in the foot (on both server and client side), why not look at some options for SSH?
I know. I'm discussing them in my post.
If you're replying on posts without reading them in their entirety, that certainly explains some of the communication issues we were having on another post (re. DANE) a while back. I don't think I'm interested in any further exchange with you.
You don't have to keep replying, but I'm going to point out that we have gotten no closer to finding a reason that anyone would even entertain the idea of SSHFP, a system that wires the already perfectly good SSH PKI subsystem into the state-controlled DNS PKI. Why would anybody ever do that?