anchor.diff:          # Generated options from other settings
           Host *
           AddressFamily ${if config.networking.enableIPv6 then "any" else "inet"}
  +        GlobalKnownHostsFile ${concatStringsSep " " knownHostsFiles}
   
           ${optionalString cfg.setXAuthLocation ''
             XAuthLocation ${pkgs.xorg.xauth}/bin/xauth
  
positive.code:                 You can fetch a public key file from a running SSH server
                  with the <command>ssh-keyscan</command> command. The content
                  of the file should follow the same format as described for
                  the <literal>publicKey</literal> option.
                '';
              };
            };
  
negative.code:       optionalString h.certAuthority "@cert-authority " + concatStringsSep "," h.hostNames + " "
        + (if h.publicKey != null then h.publicKey else readFile h.publicKeyFile)
      )) + "\n";
  
    knownHostsFiles = [ "/etc/ssh/ssh_known_hosts" "/etc/ssh/ssh_known_hosts2" ]
      ++ map pkgs.copyPathToStore cfg.knownHostsFiles;
  
  in
  {
  