SSH key management for a multi-server fleet: ed25519, ssh-agent, ProxyJump, YubiKey FIDO2, and when agent forwarding is the wrong tool

You manage five servers. Each has a different SSH key in ~/.ssh/authorized_keys from the day you set it up — one’s an old id_rsa from 2018, two have your laptop’s current ed25519 key, one has an ancient ECDSA key from …

ssh-keyscan + known_hosts + StrictHostKeyChecking: doing it right in a personal-fleet shell script

Brass padlock and matching key on a granite surface — photo by theshantanukr on Pexels

You wrote a deploy script. It SSHes into 12 servers, runs an update, comes home. The first time you run it on a fresh laptop, every server prompts: The authenticity of host ‘203.0.113.x’ can’t be established. Continue connecting (yes/no/[fingerprint])?. …