In what way are self-signed certs garbage? They're essentially the same as ssh certs.

That's a separate kind of attack, not intrinsic to the protocol. If the keypair got leaked or a CA misbehaves and issues multiple certificates that can be used for a host, then yes, it can happen.