OpenSSH silently rewrites known_hosts by default

Since OpenSSH 7.6, UpdateHostKeys is on by default: after authentication a server can quietly rewrite its known_hosts entry, adding keys and pruning pinned ones. The author reproduced it against a local sshd — a pinned key vanished, an extra server key appeared, and ssh exited 0 with no output.

• UpdateHostKeys has been enabled by default since OpenSSH 7.6
• A server can drop a pinned key and add its own
• With hashed known_hosts, a line diff hides real edits
• Mitigate with Host * UpdateHostKeys no or CA trust