let
  pi = "ssh-ed25519 AAAA..."; # Pi's SSH host public key
in
{
  "endpoint-url.age".publicKeys = [ pi ];
  "tailscale-auth-key.age".publicKeys = [ pi ];
}