Why does the ssh proxycommand require a separate program (socat)?
The proxycommand needs to be able to make the TCP connection, and although openssh is capable of doing that, we are constrained by the fact that openssh doesn’t have a hook capability that would let us adjust the known_hosts file at connection, nor does expose to us the possibility of having a hook that just verifies a key.
