anchor.diff:                the host's ssh service.
               '';
             };
  +          publicKey = mkOption {
  +            default = null;
  +            type = types.nullOr types.string;
  +            description = ''
  +              The public key data for the host. You can fetch a public key
  +              from a running SSH server with the <command>ssh-keyscan</command>
  +              command.
  +            '';
  +          };
             publicKeyFile = mkOption {
  +            default = null;
  +            type = types.nullOr types.unspecified;
               description = ''
                 The path to the public key file for the host. The public
                 key file is read at build time and saved in the Nix store.
  
positive.code:       '';
  
      assertions = [{ assertion = if cfg.forwardX11 then cfgc.setXAuthLocation else true;
                      message = "cannot enable X11 forwarding without setting xauth location";}];
  
    };
  
  
negative.code:   knownHosts = map (h: getAttr h cfg.knownHosts) (attrNames cfg.knownHosts);
  
    knownHostsFile = pkgs.writeText "ssh_known_hosts" (
      flip concatMapStrings knownHosts (h: ''
        ${concatStringsSep "," h.hostNames} ${if h.publicKey != null then h.publicKey else readFile h.publicKeyFile}
      '')
    );
  
    userOptions = {
  