anchor.diff:          default =
             [ { type = "rsa"; bits = 4096; path = "/etc/ssh/ssh_host_rsa_key"; }
               { type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
  -          ] ++ optionals supportOldHostKeys
  -          [ { type = "dsa"; path = "/etc/ssh/ssh_host_dsa_key"; }
  -            { type = "ecdsa"; bits = 521; path = "/etc/ssh/ssh_host_ecdsa_key"; }
             ];
           description = ''
             NixOS can automatically generate SSH host keys.  This option
  
positive.code:           HostKey ${k.path}
          '')}
  
          # Allow DSA client keys for now. (These were deprecated
          # in OpenSSH 7.0.)
          PubkeyAcceptedKeyTypes +ssh-dss
  
          # Re-enable DSA host keys for now.
          ${optionalString supportOldHostKeys ''
            HostKeyAlgorithms +ssh-dss
          ''}
        '';
  
      assertions = [{ assertion = if cfg.forwardX11 then cfgc.setXAuthLocation else true;
  
negative.code:       length u.openssh.authorizedKeys.keys != 0 || length u.openssh.authorizedKeys.keyFiles != 0
      ));
    in listToAttrs (map mkAuthKeyFile usersWithKeys);
  
  in
  
  