According to the Docs / Security Principles page at https://docs.syncthing.net/users/security.html when machines becomes known to each other, they both send the SHA-256 hash of their respective cert.pem’s, which are then used for verification on subsequent connections.
It’d be really nice when adding a new machine to my cluster if I could either:
Get the public key pem files from all machines in the cluster and put them on the new machine, thus allowing it to auto accept the connection requests. Likewise by putting the new machine’s pem file on the other machines it would make the initial connection very easy.
Somehow preload the SHA-256 hashes in the same way as the above, for the same reasons.
As a side note to this, is there any benefit or liability to providing an option to completely stop using SHA-256 certificate hashes, and instead allow the connection if and only if the remote machine’s public key is present.
Among other things, that should allow very quick and easy revocation of a machine in the event it’s key private files were compromised; simply delete the public keys from all systems and it is removed from the cluster.