let
  pi = "ssh-ed25519 AAAA..."; # Pi's SSH host public key
in
{
  "api-key.age".publicKeys = [ pi ];
  "inbound-api-key.age".publicKeys = [ pi ];
  "tailscale-auth-key.age".publicKeys = [ pi ];
}