anchor.diff:        optionalString h.certAuthority "@cert-authority " + concatStringsSep "," h.hostNames + " "
         + (if h.publicKey != null then h.publicKey else readFile h.publicKeyFile)
       )) + "\n";
  +
  +  knownHostsFiles = [ "/etc/ssh/ssh_known_hosts" "/etc/ssh/ssh_known_hosts2" ]
  +    ++ map pkgs.copyPathToStore cfg.knownHostsFiles;
   
   in
   {
  
positive.code:               publicKeyFile = ./pubkeys/myhost2_ssh_host_dsa_key.pub;
              };
            }
          '';
        };
  
  
negative.code:         # Generated options from other settings
          Host *
          AddressFamily ${if config.networking.enableIPv6 then "any" else "inet"}
          GlobalKnownHostsFile ${concatStringsSep " " knownHostsFiles}
  
          ${optionalString cfg.setXAuthLocation ''
            XAuthLocation ${pkgs.xorg.xauth}/bin/xauth
  