anchor.diff:                publicKeyFile = ./pubkeys/myhost2_ssh_host_dsa_key.pub;
               };
             }
  +        '';
  +      };
  +
  +      knownHostsFiles = mkOption {
  +        default = [];
  +        type = with types; listOf path;
  +        description = ''
  +          Files containing SSH host keys to set as global known hosts.
  +          <literal>/etc/ssh/ssh_known_hosts</literal> (which is
  +          generated by <option>programs.ssh.knownHosts</option>) and
  +          <literal>/etc/ssh/ssh_known_hosts2</literal> are always
  +          included.
  +        '';
  +        example = literalExpression ''
  +          [
  +            ./known_hosts
  +            (writeText "github.keys" '''
  +              github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
  +              github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
  +              github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
  +            ''')
  +          ]
           '';
         };
   
  
positive.code:       optionalString h.certAuthority "@cert-authority " + concatStringsSep "," h.hostNames + " "
        + (if h.publicKey != null then h.publicKey else readFile h.publicKeyFile)
      )) + "\n";
  
  in
  {
  
negative.code:                 You can fetch a public key file from a running SSH server
                  with the <command>ssh-keyscan</command> command. The content
                  of the file should follow the same format as described for
                  the <literal>publicKey</literal> option. Only a single key
                  is supported. If a host has multiple keys, use
                  <option>programs.ssh.knownHostsFiles</option> instead.
                '';
              };
            };
  