When is it better to use ssh-keyscan instead of ssh to manage known_hosts?
Solution 1:
Results of adding the host key to the known_hosts explicitly using ssh-keyscan or by connecting using ssh are technically the same.
Though ssh-keyscan does not really give you a chance to verify that the host key is valid. So you would have to ex-post check the contents of the known_hosts, eventually removing the key if it turns out that it is key of a malicious server. Also known_hosts contains a full key, which you can hardly verify. On the contrary the ssh shows you a fingerprint of the host key, which is easier to verify.