{config, lib, ...}: let
  magician = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII42yGEm1u3FxKdgox6Kkp9IBgBERVKrcIjQkrVbEO3m alex@kassouni.net";
  hierophant = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJqok+IgFuByRuoKM8HbiM919QmAVFvB2rI7ewgGsCiJ kassouni@hierophant";
in {
  options.my = {
    adminKeys = lib.mkOption {
      type = with lib.types; listOf singleLineStr;
      description = ''
        Keys granted an interactive shell in the wheel group, i.e. root by way
        of sudo. Only add a key you would trust with the whole machine.
      '';
    };

    gitKeys = lib.mkOption {
      type = with lib.types; listOf singleLineStr;
      description = ''
        Keys granted git-shell access to the repositories under /srv/git.
        No interactive shell and no sudo, so this is the list to grow when
        someone needs to push.
      '';
    };
  };

  config.my = {
    adminKeys = [ 
      hierophant 
      magician 
    ];

    # Admins push too; collaborator keys belong here and nowhere else.
    gitKeys = config.my.adminKeys;
  };
}