anchor.diff:    knownHosts = map (h: getAttr h cfg.knownHosts) (attrNames cfg.knownHosts);
   
     knownHostsText = flip (concatMapStringsSep "\n") knownHosts
  -    (h:
  +    (h: assert h.hostNames != [];
         concatStringsSep "," h.hostNames + " "
         + (if h.publicKey != null then h.publicKey else readFile h.publicKeyFile)
       );
  
positive.code: 
        knownHosts = mkOption {
          default = {};
          type = types.loaOf (types.submodule {
            options = {
              hostNames = mkOption {
                type = types.listOf types.str;
  
negative.code:               '';
              };
            };
            config = {
              hostNames = mkDefault [ name ];
            };
          }));
          description = ''
            The set of system-wide known SSH hosts.
          '';
  