This role uses an OpenSSH certification authority -- whose private key resides locally on the computer running Ansible -- to sign all SSH host keys of the servers.

The advantage is that, assuming a user trusts the CA for the matching domain, Trust-On-First-Use is avoided without having to manage fetching, authenticating and merging large known_hosts files.

In particular, this should be very useful in large deployments, or in cloud-based deployments with short-lived hosts.