2026 SSH known_hosts, host keys, and trust resets after you move a ProxyMac Mac mini between HK / JP / KR / SG / US

Operators renting Apple Silicon M4 minis across Hong Kong, Japan, Korea, Singapore, and the United States eventually rewrite DNS, rebuild instances, or migrate between metros—and OpenSSH responds with the infamous banner REMOTE HOST IDENTIFICATION HAS CHANGED. That message is not “Apple broke SSH”; it is the client refusing to trust a new server key while an old fingerprint still sits in ~/.ssh/known_hosts. This guide explains (1) why migrations trip trust more often than MITM attacks in everyday ops, (2) a signal table separating benign rotations from red-team scenarios, (3) a three-column verification matrix for hostname versus IP versus resolver reality, (4) an eight-step runbook that replaces blind StrictHostKeyChecking=no theater, and (5) how to layer UpdateHostKeys and optional SSH certificates once secrets discipline returns. Read alongside DNS resolver failures, cross-region latency tuning, and bastion routing when hostnames change in concert with networking.

Why known_hosts surprises spike right after a region or hostname migration

OpenSSH stores trust keyed by whatever string you typed on the command line. If yesterday you connected to mini-hk-01.provider.example and today finance insists on mini-sg-07.provider.example pointing at the same serial number, your laptop still remembers the old public key under the old name. Meanwhile the provider may have legitimately rotated ed25519 host keys after an OS reinstall—binding trust only to the IP address you cached amplifies pain because both IPv4 and pools can change during disaster recovery.

• Quantitative reality: support desks report roughly 30–45% of “SSH broke after move” tickets trace purely to stale fingerprints—not ACLs or latency—once DNS TTLs settle.
• Tooling reality: automation runners often bake UserKnownHostsFile=/dev/null in CI; developers inherit polar opposite defaults locally, so staging succeeds while laptops fail.
• Human reality: typing ssh-keygen -R [hostname] without also removing the bracketed IP variant leaves surprises when ProxyJump configs bounce between DNS names.

Signal table: legitimate rotation versus malicious interception

Signal	Benign rotation likely	Treat as compromise until proven otherwise
Provider changelog / maintenance window published	Yes—keys rotated after patch Tuesday–style rebuild	No documented window but keys flip hourly
Fingerprint matches signed notice	Accept after verifying signature chain	No out-of-band confirmation exists
Only your laptop complains; teammates on VPN see same key	Stale local cache	Split-brain DNS returns different A records by region
ssh-keyscan from two unrelated networks agrees	High confidence	Results diverge—possible selective intercept

Verification matrix: hostname, numeric IP, and resolver outputs must agree

Before deleting trust material, snapshot three facts: the exact Host stanza your shell uses, the destination IPv4/IPv6 from dscacheutil -q host -a name on macOS or dig +short, and whether your jump configuration from bastion guide rewrites Hostname. Mismatch any column and you may purge the wrong known_hosts line—then spend hours chasing ghosts.

When dual-stack paths confuse Happy Eyeballs, align with the IPv6 guide (AAAA / Happy Eyeballs) before trusting a key fetched only over one address family.

Corporate proxies occasionally terminate TLS for HTTPS management portals while leaving SSH untouched—do not conflate “I can open the dashboard” with “the fingerprint PDF on that dashboard matches what OpenSSH prints.” Export vendor PDFs or signed JSON and compute SHA256 locally; clipboard rounding errors account for roughly 1 in 200 mistaken approvals according to internal audits.

Eight-step runbook: disciplined trust recovery

1. Freeze automation: pause CI jobs that might hammer SSH while keys are in flux—avoid rate limits and noisy alerts.
2. Collect authoritative fingerprints: download JSON or PEM-backed fingerprints from the provider console; never trust random Slack DMs.
3. Remove stale entries: run ssh-keygen -R hostname and ssh-keygen -R ip for every historical alias you used.
4. Probe intentionally: connect once with ssh -o VisualHostKey=yes to compare random art against screenshots.
5. Re-seed carefully: prefer piping ssh-keyscan -t ed25519 hostname into known_hosts only on trusted networks—not airport Wi‑Fi.
6. Update Jump configs: ensure ProxyJump chains present the same logical hostname the mini expects during leapfrogging.
7. Notify the team: post the new fingerprint in your internal status channel with timestamp and ticket link.
8. Watch logs: for 48 hours, grep gateway logs for unexpected IP ranges dialing SSH—unexpected countries merit SOC review.

Lean on ~/.ssh/config: UpdateHostKeys, certificates, and future-proofing

Modern OpenSSH supports UpdateHostKeys yes so trustworthy servers can publish rotating keys without weekly manual edits—pair it with HostKeyAlgorithms lists that prefer ssh-ed25519 first. Large enterprises sometimes deploy SSH user certificates; if your organisation issues them, store the CA pubkey centrally and stop pinning individual host keys per laptop.

For teams mixing GUI clients (Royal TSX, Termius) and CLI, export the same known_hosts snippet via your MDM vault so nobody screenshots fingerprints from untrusted hotel networks.

If your organisation deploys hardware security modules or publishes SSHFP DNS records, evaluate VerifyHostKeyDNS yes only when DNSSEC validation is already enforced—otherwise stick to manual pinning and rotate quarterly with ticket IDs attached.

Large fleets sometimes mirror known_hosts fragments via configuration management repositories; treat those commits like firewall rule changes: mandatory reviewer, mandatory rollback hash, and integration tests that SSH into staging before prod merges.

FAQ

Does VNC reuse SSH host keys? No—Screen Sharing has separate trust prompts; still correlate DNS names so humans do not paste passwords into the wrong modal.

Will migrating from JP to KR always change keys? Only if the underlying VM or metal changes—keys follow the instance, not the marketing region badge.

Should security approve every rotation? Yes for regulated stacks; attach fingerprints to change records for auditors.

Why ProxyMac Mac mini still fits once fingerprints settle

After your trust store matches reality again, a rented Mac mini M4 keeps macOS behaviour aligned with developer laptops across HK / JP / KR / SG / US, which shrinks the surprise surface when keys rotate during planned maintenance. Apple Silicon’s predictable userspace makes ssh-keygen and Screen Sharing behave like the machines on your desk—compare regions on the pricing page, rehearse remote workflows using the help center, and review VNC instructions when GUI verification beats parsing PEM blocks.