As mentioned elsewhere in this thread, actually using SSHFP in a secure way is difficult.

Far better is to use SSH host certificates, then your known_hosts can simply have a @cert-authority * some-cert in it. (See https://www.lorier.net/docs/ssh-ca.html)