Using certificates for SSH authentication

We use host certificates for our 1000s of servers signed at the time of deployment. In our known_hosts, there is only one entry:

@cert-authority * ecdsa-sha2-nistp256 XXXXXXXXXXXXXXXXXXXXXX CA

And we never get prompted for host key verification. The only reason we get prompted is if we made a typo, or something is really wrong.