anchor.diff:  
       networking.firewall.allowedTCPPorts = cfg.ports;
   
  +    services.openssh.authorizedKeysFiles =
  +      [ ".ssh/authorized_keys" ".ssh/authorized_keys2" "/etc/ssh/authorized_keys.d/%u" ];
  +
       services.openssh.extraConfig =
         ''
           Protocol 2
  
positive.code:           started for the first time. Otherwise, the ssh daemon will
            use the specified key directly in-place.
          '';
        };
  
        extraConfig = mkOption {
  
negative.code:         PasswordAuthentication ${if cfg.passwordAuthentication then "yes" else "no"}
          ChallengeResponseAuthentication ${if cfg.challengeResponseAuthentication then "yes" else "no"}
  
          AuthorizedKeysFile ${toString cfg.authorizedKeysFiles}
        '';
  
      assertions = [{ assertion = if cfg.forwardX11 then cfgc.setXAuthLocation else true;
  