anchor.diff:        dropbear -s -j -k -E -m -p ${toString cfg.port}
       '';
   
  +    boot.initrd.secrets =
  +     (optionalAttrs (cfg.hostRSAKey != null) { "/etc/dropbear/dropbear_rsa_host_key" = cfg.hostRSAKey; }) //
  +     (optionalAttrs (cfg.hostDSSKey != null) { "/etc/dropbear/dropbear_dss_host_key" = cfg.hostDSSKey; }) //
  +     (optionalAttrs (cfg.hostECDSAKey != null) { "/etc/dropbear/dropbear_ecdsa_host_key" = cfg.hostECDSAKey; });
  +
     };
   
   }
  
positive.code:       description = ''
          DSS SSH private key file in the Dropbear format.
  
          WARNING: This key is contained insecurely in the global Nix store. Do NOT
          use your regular SSH host private keys for this purpose or you'll expose
          them to regular users!
        '';
      };
  
  
negative.code:       description = ''
          ECDSA SSH private key file in the Dropbear format.
  
          WARNING: Unless your bootloader supports initrd secrets, this key is
          contained insecurely in the global Nix store. Do NOT use your regular
          SSH host private keys for this purpose or you'll expose them to
          regular users!
        '';
      };
  
  