I would have guessed that the significant majority would be using TOFU, but in any case the actual key was leaked so it wouldn't matter which method was used.
The point is about how much people care, not about whether verification works or not when the key is leaked.
> Number of people just not blindly using TOFU with github over ssh must be quite low.
Oh, I missed the "not" the first time I read it, which changed your overall meaning entirely. My bad.
Re:We updated our RSA SSH host key
by jessaustin on Friday March 24, 2023 @01:05PM
(#35292105)
In this case "not just" would have been more legible than "just not".
Number of people just not blindly using TOFU with github over ssh must be quite low.
Who here went here https://docs.github.com/en/authentication/keeping-your-accou... and added the keys manually to known_hosts before using github for the first time?