Add the old github keys as revoked

[est31]

The patch to update the bundled ssh github host key did not change anything for users who already had connected to github one time before via ssh: if the attacker had access to the old key, they'd be vulnerable to MITM attacks as their known_hosts file would list the old github key. Only if they connected again to github without attacker access, or if they saw the announcement of the key rotation, they would update their key.

There is sadly no other way to distribute revocations of old host keys to clients other than to bundle them with client software.

cc #11883

[rustbot]

r? @epage

(rustbot has picked a reviewer for you, use r? to override)

[est31]

Testing this locally with adding the keys currently used by github gives the expected error message:

$ target/release/cargo update
    Updating crates.io index
    Updating git repository `ssh://git@github.com/est31/rcgen/`
error: failed to get `rcgen` as a dependency of package `cargo v0.71.0 (/home/user/src/cargo)`

Caused by:
  failed to load source for dependency `rcgen`

Caused by:
  Unable to update ssh://git@github.com/est31/rcgen/

Caused by:
  failed to fetch into: /home/user/.cargo/git/db/rcgen-340d94e2a3e51285

Caused by:
  error: Key has been revoked for `github.com`
  **************************************
  * WARNING: REVOKED HOST KEY DETECTED *
  **************************************
  This may indicate that the key provided by this host has been
  compromised and should not be accepted.
                  
  The host key ECDSA AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg= is revoked
  in builtin cargo configuration and has been rejected.

[ehuss]

Thanks! This seems reasonable to me, and I've tested that it works.

@bors r+

[bors]

📌 Commit cd654c7 has been approved by ehuss

It is now in the queue for this repository.

[bors]

⌛ Testing commit cd654c7 with merge d002ceb...

[bors]

☀️ Test successful - checks-actions
Approved by: ehuss
Pushing d002ceb to master...