anchor.diff:        optionalString h.certAuthority "@cert-authority " + concatStringsSep "," h.hostNames + " "
         + (if h.publicKey != null then h.publicKey else readFile h.publicKeyFile)
       )) + "\n";
  +
  +  knownHostsFiles = [ "/etc/ssh/ssh_known_hosts" "/etc/ssh/ssh_known_hosts2" ]
  +    ++ map pkgs.copyPathToStore cfg.knownHostsFiles;
   
   in
   {
  
positive.code:               publicKeyFile = ./pubkeys/myhost2_ssh_host_dsa_key.pub;
              };
            }
          '';
        };
  
  
negative.code:                 You can fetch a public key file from a running SSH server
                  with the <command>ssh-keyscan</command> command. The content
                  of the file should follow the same format as described for
                  the <literal>publicKey</literal> option. Only a single key
                  is supported. If a host has multiple keys, use
                  <option>programs.ssh.knownHostsFiles</option> instead.
                '';
              };
            };
  