adding ssh host signing

scripts/extract-artifacts.sh

@@ -134,9 +134,12 @@ rm -rf "$WORK/root/boot/"* "$WORK/rootfs.tar"   # diskless hosts don't need /boo
 # sshd rejects them ("Permissions 640 ... too open") and refuses to start.
 # RHEL's sshd-keygen@.service regenerates them with correct perms before sshd
 # starts, into the writable volatile overlay. NOTE: with the ephemeral overlay
-# they regenerate EVERY boot, so the host key changes each reboot (SSH clients
-# will warn) — for a stable identity, persist them or derive from the TPM
-# (future; ties to the hostnqn/identity model).
+# they regenerate EVERY boot, so the raw host key changes each reboot. This no
+# longer causes client TOFU warnings: fleet-ssh-hostcert (files/ssh-hostcert,
+# enabled via 2b-ssh-hostcert) gets the per-boot key signed by the fleet SSH CA
+# at boot, so admins trust every host via one `@cert-authority` line instead of
+# pinning a per-boot key (F-02 / POA&M P-17; docs/ssh-host-certificate-design.md).
+# A STABLE TPM-resident host key (Design B) remains a deferred follow-on.
 rm -f "$WORK/root/etc/ssh/"ssh_host_*
 
 # Fail loudly if labels didn't make it — shipping an unlabeled enforcing image