> I have thought that the gss keyex spec should allow the server to send > its public host keys (as opposed to one public host key). Do you have a reasonable way to implement this that doesn't break interoperability? Are there implementations in the wild that send the host's public key?