The server does not know any secrets that can be used to authenticate itself.

Also, what good is a fingerprint if it is based on the public key if it is basically the hash of some known public key.

What protection is there from an "ssh server spoofing"?