[vaporary]

SSH host certificates as somewhat of an abomination

Many would say x509 is the real abomination.

[OrvalWintermute]

I might not disagree with you there.

However, for all its warts, x509 due to hardware implementations, seems a great deal more secure than sitting on the FS SSH host certificates.

[fmajid]

OpenSSH supports FIDO keys since 8.2p1 and has supported smart cards via GPG longer.