{ config, ... }:
{
  users.users.root.openssh.authorizedKeys.keys =
    if config.services.openssh.enable
    then (import ../secrets/lib/authorized_keys).admins
    else [];
}