Using certificates for SSH authentication

> But what usually happens is that the user answers "yes" by reflex.

Instead of "yes", in OpenSSH versions 8.0 or later, you can also paste the expected key fingerprint. If they match it's equivalent to "yes", if not it's equivalent to "no".

It's not as good as a cert verification, but it's better than manually comparing fingerprint bytes.