Comment by cynix

> you do not need to pass around authorized_keys to all hosts.

But now I need to trust these random host keys, instead of a key signed by my SSH CA...