Good to know. Yeah, the keys are regenerated, but they have a lifespan. I'm showing a default regeneration interval of 1H on my system, and that's about what I remember from looking at it in the past, so it's not that bad. The more I read on this, it sounds like the attack vector on this is such that it is likely the surface are of ssh is pretty small, if it exists at all. That makes me happy, but doesn't completely dispell my inborn paranoia. :-) I expect to see new ssh binaries in the pipeline soon enough. The folks who maintain ssh are pretty paranoid as well, so they'll likely take a close look at the fix first to make sure it doesn't break anything else. SSH is a critical utility.
I only use the CLI for OpenSSH to generate login keys for my jump servers. This allows me to turn off password-based authentication and use certificates only. That reduces the chance of a successful brute force attack manifold.