x/crypto/ssh: make ClientConfig HostKeyCallback non-permissive by default #19767
Description
ClientConfig.HostKeyCallback interprets nil as "accept any host keys". This is not a great default from a security perspective. Many clients probably should set HostKeyCallback to something real but are not.
It was written this way in golang.org/cl/9922043 to preserve backwards compatibility with the original implementation, but that was probably not the right balance to strike.
This issue is to make HostKeyCallback=nil mean "reject all host keys" and at the same time provide at least
func InsecureSkipVerifyHostKey() HostKeyChecker
func FixedHostKey(key []byte) HostKeyChecker
and maybe also
func HostKeysFile(file string) HostKeyChecker
Thanks to Phil Pennock for pointing out this problem.