Using certificates for SSH authentication

> But what usually happens is that the user answers "yes" by reflex.

In many of the environments where I have worked, the sysadmins would stare at me with a confused look, when asked them to confirm a fingerprint...