@FiXato @tomasino I think DNS TXT records certainly have potential, but is there a portable way to query them? I’ve understood it’s either done with tools like nslookup or one has to talk to the DNS servers directly, and somehow figure out the user’s nameserver configuration.

@jk @FiXato SSHFP has a bunch of convenient methods in various tools, like dig, but we'd have to develop our own for txt entries. There's patterns we could follow, though. Email has been inventing new ones a lot in the last decade.

Even if we come up with a pattern and it works it won't ever be universally applied and implemented, though, so at best this provides /a/ way to automate out-of-band TOFU