John, the mismatch between the key and the hostname is also potentially unsafe because the hostname may have changed since the ecdsa was created.

I think the best we can do is to match variations of tkldev and fab-dev in the offending key.