anchor.diff:            started for the first time. Otherwise, the ssh daemon will
             use the specified key directly in-place.
           '';
  +      };
  +
  +      authorizedKeysFiles = mkOption {
  +        default = [];
  +        description = "Files from with authorized keys are read.";
         };
   
         extraConfig = mkOption {
  
positive.code: 
      networking.firewall.allowedTCPPorts = cfg.ports;
  
      services.openssh.extraConfig =
        ''
          Protocol 2
  
negative.code:         PasswordAuthentication ${if cfg.passwordAuthentication then "yes" else "no"}
          ChallengeResponseAuthentication ${if cfg.challengeResponseAuthentication then "yes" else "no"}
  
          AuthorizedKeysFile ${toString cfg.authorizedKeysFiles}
        '';
  
      assertions = [{ assertion = if cfg.forwardX11 then cfgc.setXAuthLocation else true;
  