I’ve yet to find a project which actually bothered implementing hostkey verification in SSH client code. None.

Great comparison of responses at two levels, language vendor and downstream project.

Anyone using SSH as a client in Golang who wants to keep being insecure will need to explicitly mark it as such in their codebase and face public ridicule.

source: L