Compares two ssh pubkey fingerprints.  One fingerprint is obtained from AWS over TLS.  The associated IP address is also obtained over TLS.  ssh-keyscan uses TLS authenticated IP address to request ssh data.  The fingerprint that results from the scan is compared with the TLS authenticated one.  Success results in the associated pubkey being added with its hashed IP to .ssh/known_hosts.