Where is the new ssh.bitbucket.org key signature published?

Karl Roberts

In the announcement re the change to bitbucket's ssh host you say "When you see the prompt, review the fingerprint and, if it matches Bitbucket’s published values, choose “yes” to continue."

Where is that published? you should/could have mentioned it in the article

Mihai_LeanZero

Same place as the old ones. No separate page for the new host. ssh-keyscan against both today returns the exact same three keys, so compare with SSH host keys here, labelled bitbucket.org, which doesn't help: https://support.atlassian.com/bitbucket-cloud/docs/configure-ssh-and-two-step-verification/

ED25519 SHA256:ybgmFkzwOSotHTHLJgHO0QN8L0xErw6vd0VhFA9m3SM
ECDSA SHA256:FC73VB6C4OQLSCrjEayhMp9UMxS97caD/Yyi2bhW/J0
RSA SHA256:46OSHA1Rmj8E8ERTC6xkNcmGOw9oFxYr0WF6zWW8l1E

Shared keys aren't spelled out in the announcement or the docs. The curl | sed line in the announcement relies on it though. It pulls the known_hosts lines from https://bitbucket.org/site/ssh and renames the host.

Accepting the prompt instead? Check its hash against the docs page. The prompt alone only tells what the server claims

Agree it belonged in the article though.