KNOWNHOSTS REVOCATION GAP PATCHED

golang/crypto closed a security gap in ssh/knownhosts: revocation matching compared full marshaled key blobs, so a @revoked line with a plain host key failed to revoke a certificate certifying that key. The fix aligns with OpenSSH's check_key_not_revoked, which compares only public key portions. This matters for any SSH client that relies on certificate-based host key verification. The one-line functional change makes IsRevoked match the underlying public key instead of the entire certificate blob. That means a revoked host key now properly blocks certificates chaining to it. If you vendor golang/crypto, update before your next deployment. It's a subtle fix with a real security impact.