(command.CommandList
  children: [
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:tid)
          op: assign_op.Equal
          rhs: {(DQ <'ssh-keygen known_hosts'>)}
          spids: [7]
        )
      ]
    )
    (C {<rm>} {<-f>} {($ Id.VSub_DollarName '$OBJ') <'/kh.'> <Id.Lit_Star '*'>})
    (command.ForEach
      iter_name: x
      iter_words: [{<host-a>} {<host-b>} {<host-c>} {<host-d>} {<host-e>} {<host-f>} {<host-a2>} {<host-b2>}]
      do_arg_iter: F
      body: 
        (command.DoGroup
          children: [
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (C {(${ Id.VSub_Name SSHKEYGEN)} {<-qt>} {<ed25519>} {<-f>} 
                  {($ Id.VSub_DollarName '$OBJ') <'/kh.'> ($ Id.VSub_DollarName '$x')} {<-C>} {(DQ ($ Id.VSub_DollarName '$x'))} {<-N>} {(DQ )}
                )
                (C {<fatal>} {(DQ <'ssh-keygen failed'>)})
              ]
            )
            (command.Simple
              words: [{<echo>} {(DQ <'# '> ($ Id.VSub_DollarName '$x'))}]
              redirects: [
                (redir
                  op: <Id.Redir_DGreat '>>'>
                  loc: (redir_loc.Fd fd:1)
                  arg: {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts'>}
                )
              ]
              do_fork: T
            )
            (command.Subshell
              child: 
                (command.CommandList
                  children: [
                    (command.Case
                      to_match: {(DQ ($ Id.VSub_DollarName '$x'))}
                      arms: [
                        (case_arm
                          pat_list: [{<host-a>} {<host-b>}]
                          action: [(C {<printf>} {(DQ ($ Id.VSub_DollarName '$x') <' '>)})]
                          spids: [116 119 128 -1]
                        )
                        (case_arm
                          pat_list: [{<host-c>}]
                          action: [
                            (C {<printf>} {(DQ <'@cert-authority '> ($ Id.VSub_DollarName '$x') <' '>)})
                          ]
                          spids: [131 132 142 -1]
                        )
                        (case_arm
                          pat_list: [{<host-d>}]
                          action: [(C {<printf>} {(DQ <'@revoked '> ($ Id.VSub_DollarName '$x') <' '>)})]
                          spids: [145 146 156 -1]
                        )
                        (case_arm
                          pat_list: [{<host-e>}]
                          action: [(C {<printf>} {(DQ <'host-e* '>)})]
                          spids: [159 160 168 -1]
                        )
                        (case_arm
                          pat_list: [{<host-f>}]
                          action: [(C {<printf>} {(DQ <'host-f,host-g,host-h '>)})]
                          spids: [171 172 180 -1]
                        )
                        (case_arm
                          pat_list: [{<host-a2>}]
                          action: [(C {<printf>} {(DQ <'host-a '>)})]
                          spids: [183 184 192 -1]
                        )
                        (case_arm
                          pat_list: [{<host-b2>}]
                          action: [(C {<printf>} {(DQ <'host-b '>)})]
                          spids: [195 196 204 -1]
                        )
                      ]
                    )
                    (C {<cat>} {($ Id.VSub_DollarName '$OBJ') <'/kh.'> (${ Id.VSub_Name x) <.pub>})
                    (command.Simple
                      words: [{<echo>} {(DQ )}]
                      redirects: [
                        (redir
                          op: <Id.Redir_DGreat '>>'>
                          loc: (redir_loc.Fd fd:1)
                          arg: {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts'>}
                        )
                      ]
                      do_fork: T
                    )
                  ]
                )
              redirects: [
                (redir
                  op: <Id.Redir_DGreat '>>'>
                  loc: (redir_loc.Fd fd:1)
                  arg: {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts'>}
                )
              ]
            )
          ]
        )
    )
    (command.Simple
      words: [{<cat>} {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts'>}]
      redirects: [
        (redir
          op: <Id.Redir_DGreat '>>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/kh.invalid'>}
        )
      ]
      do_fork: T
    )
    (command.Simple
      words: [{<echo>} {(DQ <'host-i '>)}]
      redirects: [
        (redir
          op: <Id.Redir_DGreat '>>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/kh.invalid'>}
        )
      ]
      do_fork: T
    )
    (C {<cp>} {($ Id.VSub_DollarName '$OBJ') <'/kh.invalid'>} 
      {($ Id.VSub_DollarName '$OBJ') <'/kh.invalid.orig'>}
    )
    (C {<cp>} {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts'>} 
      {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts.orig'>}
    )
    (command.ShFunction
      name: expect_key
      body: 
        (BraceGroup
          children: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_host)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$1')}
                  spids: [300]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_hosts)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$2')}
                  spids: [304]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_key)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$3')}
                  spids: [308]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_line)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$4')}
                  spids: [312]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_mark)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$5')}
                  spids: [316]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_marker)
                  op: assign_op.Equal
                  rhs: {(DQ )}
                  spids: [320]
                )
              ]
            )
            (command.AndOr
              ops: [Id.Op_DAmp]
              children: [
                (C {<test>} {(DQ <x> ($ Id.VSub_DollarName '$_mark'))} {<Id.Lit_Equals '='>} {(DQ <xCA>)})
                (command.ShAssignment
                  pairs: [
                    (assign_pair
                      lhs: (sh_lhs_expr.Name name:_marker)
                      op: assign_op.Equal
                      rhs: {(DQ <'@cert-authority '>)}
                      spids: [340]
                    )
                  ]
                )
              ]
            )
            (command.AndOr
              ops: [Id.Op_DAmp]
              children: [
                (C {<test>} {(DQ <x> ($ Id.VSub_DollarName '$_mark'))} {<Id.Lit_Equals '='>} 
                  {(DQ <xREVOKED>)}
                )
                (command.ShAssignment
                  pairs: [
                    (assign_pair
                      lhs: (sh_lhs_expr.Name name:_marker)
                      op: assign_op.Equal
                      rhs: {(DQ <'@revoked '>)}
                      spids: [361]
                    )
                  ]
                )
              ]
            )
            (command.AndOr
              ops: [Id.Op_DAmp]
              children: [
                (C {<test>} {(DQ <x> ($ Id.VSub_DollarName '$_line'))} 
                  {<Id.KW_Bang '!'> <Id.Lit_Equals '='>} {(DQ <x>)}
                )
                (command.Simple
                  words: [
                    {<echo>}
                    {
                      (DQ <'# Host '> ($ Id.VSub_DollarName '$_host') <' found: line '> 
                        ($ Id.VSub_DollarName '$_line') <' '> ($ Id.VSub_DollarName '$_mark')
                      )
                    }
                  ]
                  redirects: [
                    (redir
                      op: <Id.Redir_DGreat '>>'>
                      loc: (redir_loc.Fd fd:1)
                      arg: {($ Id.VSub_DollarName '$OBJ') <'/kh.expect'>}
                    )
                  ]
                  do_fork: T
                )
              ]
            )
            (command.Simple
              words: [{<printf>} {(DQ (${ Id.VSub_Name _marker) ($ Id.VSub_DollarName '$_hosts') <' '>)}]
              redirects: [
                (redir
                  op: <Id.Redir_DGreat '>>'>
                  loc: (redir_loc.Fd fd:1)
                  arg: {($ Id.VSub_DollarName '$OBJ') <'/kh.expect'>}
                )
              ]
              do_fork: T
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (command.Simple
                  words: [
                    {<cat>}
                    {($ Id.VSub_DollarName '$OBJ') <'/kh.'> (${ Id.VSub_Name _key) <.pub>}
                  ]
                  redirects: [
                    (redir
                      op: <Id.Redir_DGreat '>>'>
                      loc: (redir_loc.Fd fd:1)
                      arg: {($ Id.VSub_DollarName '$OBJ') <'/kh.expect'>}
                    )
                  ]
                  do_fork: T
                )
                (C {<fatal>} {(DQ (${ Id.VSub_Name _key) <'.pub missing'>)})
              ]
            )
          ]
        )
    )
    (command.ShFunction
      name: check_find
      body: 
        (BraceGroup
          children: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_host)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$1')}
                  spids: [453]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_name)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$2')}
                  spids: [457]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_keygenopt)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$3')}
                  spids: [461]
                )
              ]
            )
            (command.Simple
              words: [
                {(${ Id.VSub_Name SSHKEYGEN)}
                {($ Id.VSub_DollarName '$_keygenopt')}
                {<-f>}
                {($ Id.VSub_DollarName '$OBJ') <'/kh.invalid'>}
                {<-F>}
                {($ Id.VSub_DollarName '$_host')}
              ]
              redirects: [
                (redir
                  op: <Id.Redir_Great '>'>
                  loc: (redir_loc.Fd fd:1)
                  arg: {($ Id.VSub_DollarName '$OBJ') <'/kh.result'>}
                )
              ]
              do_fork: T
            )
            (command.If
              arms: [
                (if_arm
                  cond: 
                    (condition.Shell
                      commands: [
                        (command.Sentence
                          child: 
                            (command.Pipeline
                              children: [
                                (C {<diff>} {<-w>} {($ Id.VSub_DollarName '$OBJ') <'/kh.expect'>} 
                                  {($ Id.VSub_DollarName '$OBJ') <'/kh.result'>}
                                )
                              ]
                              negated: T
                            )
                          terminator: <Id.Op_Semi _>
                        )
                      ]
                    )
                  action: [(C {<fail>} {(DQ <'didn\'t find '> ($ Id.VSub_DollarName '$_name'))})]
                  spids: [486 502]
                )
              ]
            )
          ]
        )
    )
    (C {<rm>} {<-f>} {($ Id.VSub_DollarName '$OBJ') <'/kh.expect'>})
    (C {<expect_key>} {<host-a>} {<host-a>} {<host-a>} {<2>})
    (C {<expect_key>} {<host-a>} {<host-a>} {<host-a2>} {<20>})
    (C {<check_find>} {<host-a>} {(DQ <'simple find'>)})
    (C {<rm>} {<-f>} {($ Id.VSub_DollarName '$OBJ') <'/kh.expect'>})
    (C {<expect_key>} {<host-c>} {<host-c>} {<host-c>} {<8>} {<CA>})
    (C {<check_find>} {<host-c>} {(DQ <'find CA key'>)})
    (C {<rm>} {<-f>} {($ Id.VSub_DollarName '$OBJ') <'/kh.expect'>})
    (C {<expect_key>} {<host-d>} {<host-d>} {<host-d>} {<11>} {<REVOKED>})
    (C {<check_find>} {<host-d>} {(DQ <'find revoked key'>)})
    (C {<rm>} {<-f>} {($ Id.VSub_DollarName '$OBJ') <'/kh.expect'>})
    (C {<expect_key>} {<host-e.somedomain>} {(DQ <'host-e*'>)} {<host-e>} {<14>})
    (C {<check_find>} {<host-e.somedomain>} {(DQ <'find wildcard key'>)})
    (C {<rm>} {<-f>} {($ Id.VSub_DollarName '$OBJ') <'/kh.expect'>})
    (C {<expect_key>} {<host-h>} {(DQ <'host-f,host-g,host-h '>)} {<host-f>} {<17>})
    (C {<check_find>} {<host-h>} {(DQ <'find multiple hosts'>)})
    (command.ShFunction
      name: check_hashed_find
      body: 
        (BraceGroup
          children: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_host)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$1')}
                  spids: [688]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_name)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$2')}
                  spids: [692]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:_file)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$3')}
                  spids: [696]
                )
              ]
            )
            (command.AndOr
              ops: [Id.Op_DAmp]
              children: [
                (C {<test>} {(DQ <x> ($ Id.VSub_DollarName '$_file'))} {<Id.Lit_Equals '='>} {(DQ <x>)})
                (command.ShAssignment
                  pairs: [
                    (assign_pair
                      lhs: (sh_lhs_expr.Name name:_file)
                      op: assign_op.Equal
                      rhs: {($ Id.VSub_DollarName '$OBJ') <'/kh.invalid'>}
                      spids: [715]
                    )
                  ]
                )
              ]
            )
            (command.Pipeline
              children: [
                (C {(${ Id.VSub_Name SSHKEYGEN)} {<-f>} {($ Id.VSub_DollarName '$_file')} {<-HF>} 
                  {($ Id.VSub_DollarName '$_host')}
                )
                (C {<grep>} {(SQ <'|1|'>)})
                (command.Simple
                  words: [{<sed>} {(DQ <'s/^[^ ]*/'> ($ Id.VSub_DollarName '$_host') <'/'>)}]
                  redirects: [
                    (redir
                      op: <Id.Redir_Great '>'>
                      loc: (redir_loc.Fd fd:1)
                      arg: {($ Id.VSub_DollarName '$OBJ') <'/kh.result'>}
                    )
                  ]
                  do_fork: T
                )
              ]
              negated: F
            )
            (command.If
              arms: [
                (if_arm
                  cond: 
                    (condition.Shell
                      commands: [
                        (command.Sentence
                          child: 
                            (command.Pipeline
                              children: [
                                (C {<diff>} {<-w>} {($ Id.VSub_DollarName '$OBJ') <'/kh.expect'>} 
                                  {($ Id.VSub_DollarName '$OBJ') <'/kh.result'>}
                                )
                              ]
                              negated: T
                            )
                          terminator: <Id.Op_Semi _>
                        )
                      ]
                    )
                  action: [(C {<fail>} {(DQ <'didn\'t find '> ($ Id.VSub_DollarName '$_name'))})]
                  spids: [758 774]
                )
              ]
            )
          ]
        )
    )
    (C {<rm>} {<-f>} {($ Id.VSub_DollarName '$OBJ') <'/kh.expect'>})
    (C {<expect_key>} {<host-a>} {<host-a>} {<host-a>})
    (C {<expect_key>} {<host-a>} {<host-a>} {<host-a2>})
    (C {<check_hashed_find>} {<host-a>} {(DQ <'find simple and hash'>)})
    (C {<rm>} {<-f>} {($ Id.VSub_DollarName '$OBJ') <'/kh.expect'>})
    (C {<expect_key>} {<host-c>} {<host-c>} {<host-c>} {(DQ )} {<CA>})
    (C {<check_find>} {<host-c>} {(DQ <'find simple and hash'>)} {<-H>})
    (C {<rm>} {<-f>} {($ Id.VSub_DollarName '$OBJ') <'/kh.expect'>})
    (C {<expect_key>} {<host-d>} {<host-d>} {<host-d>} {(DQ )} {<REVOKED>})
    (C {<check_find>} {<host-d>} {(DQ <'find simple and hash'>)} {<-H>})
    (C {<rm>} {<-f>} {($ Id.VSub_DollarName '$OBJ') <'/kh.expect'>})
    (C {<expect_key>} {<host-e>} {(DQ <'host-e*'>)} {<host-e>} {(DQ )})
    (C {<check_find>} {<host-e>} {(DQ <'find wildcard key'>)} {<-H>})
    (C {<rm>} {<-f>} {($ Id.VSub_DollarName '$OBJ') <'/kh.expect'>})
    (C {<expect_key>} {<host-f>} {(DQ <'host-h '>)} {<host-f>})
    (C {<expect_key>} {<host-g>} {(DQ <'host-h '>)} {<host-f>})
    (C {<expect_key>} {<host-h>} {(DQ <'host-h '>)} {<host-f>})
    (C {<check_hashed_find>} {<host-h>} {(DQ <'find multiple hosts'>)})
    (C {<cp>} {($ Id.VSub_DollarName '$OBJ') <'/kh.invalid.orig'>} 
      {($ Id.VSub_DollarName '$OBJ') <'/kh.invalid'>}
    )
    (command.Simple
      words: [
        {(${ Id.VSub_Name SSHKEYGEN)}
        {<-qf>}
        {($ Id.VSub_DollarName '$OBJ') <'/kh.invalid'>}
        {<-R>}
        {<host-a>}
      ]
      redirects: [(redir op:<Id.Redir_Great '2>'> loc:(redir_loc.Fd fd:2) arg:{<'/dev/null'>})]
      do_fork: T
    )
    (command.AndOr
      ops: [Id.Op_DPipe]
      children: [
        (C {<diff>} {($ Id.VSub_DollarName '$OBJ') <'/kh.invalid'>} 
          {($ Id.VSub_DollarName '$OBJ') <'/kh.invalid.orig'>}
        )
        (C {<fail>} {(DQ <'remove on invalid succeeded'>)})
      ]
    )
    (C {<cp>} {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts.orig'>} 
      {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts'>}
    )
    (command.Simple
      words: [
        {(${ Id.VSub_Name SSHKEYGEN)}
        {<-qf>}
        {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts'>}
        {<-R>}
        {<host-a>}
      ]
      redirects: [(redir op:<Id.Redir_Great '2>'> loc:(redir_loc.Fd fd:2) arg:{<'/dev/null'>})]
      do_fork: T
    )
    (command.Simple
      words: [{<grep>} {<-v>} {(DQ <'^host-a '>)} {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts.orig'>}]
      redirects: [
        (redir
          op: <Id.Redir_Great '>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/kh.expect'>}
        )
      ]
      do_fork: T
    )
    (command.AndOr
      ops: [Id.Op_DPipe]
      children: [
        (C {<diff>} {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts'>} 
          {($ Id.VSub_DollarName '$OBJ') <'/kh.expect'>}
        )
        (C {<fail>} {(DQ <'remove simple'>)})
      ]
    )
    (C {<cp>} {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts.orig'>} 
      {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts'>}
    )
    (command.Simple
      words: [
        {(${ Id.VSub_Name SSHKEYGEN)}
        {<-qf>}
        {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts'>}
        {<-R>}
        {<host-c>}
      ]
      redirects: [(redir op:<Id.Redir_Great '2>'> loc:(redir_loc.Fd fd:2) arg:{<'/dev/null'>})]
      do_fork: T
    )
    (command.AndOr
      ops: [Id.Op_DPipe]
      children: [
        (C {<diff>} {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts'>} 
          {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts.orig'>}
        )
        (C {<fail>} {(DQ <'remove CA'>)})
      ]
    )
    (C {<cp>} {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts.orig'>} 
      {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts'>}
    )
    (command.Simple
      words: [
        {(${ Id.VSub_Name SSHKEYGEN)}
        {<-qf>}
        {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts'>}
        {<-R>}
        {<host-d>}
      ]
      redirects: [(redir op:<Id.Redir_Great '2>'> loc:(redir_loc.Fd fd:2) arg:{<'/dev/null'>})]
      do_fork: T
    )
    (command.AndOr
      ops: [Id.Op_DPipe]
      children: [
        (C {<diff>} {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts'>} 
          {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts.orig'>}
        )
        (C {<fail>} {(DQ <'remove revoked'>)})
      ]
    )
    (C {<cp>} {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts.orig'>} 
      {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts'>}
    )
    (command.Simple
      words: [
        {(${ Id.VSub_Name SSHKEYGEN)}
        {<-qf>}
        {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts'>}
        {<-R>}
        {<host-e.blahblah>}
      ]
      redirects: [(redir op:<Id.Redir_Great '2>'> loc:(redir_loc.Fd fd:2) arg:{<'/dev/null'>})]
      do_fork: T
    )
    (command.Simple
      words: [{<grep>} {<-v>} {(DQ <'^host-e[*] '>)} {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts.orig'>}]
      redirects: [
        (redir
          op: <Id.Redir_Great '>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/kh.expect'>}
        )
      ]
      do_fork: T
    )
    (command.AndOr
      ops: [Id.Op_DPipe]
      children: [
        (C {<diff>} {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts'>} 
          {($ Id.VSub_DollarName '$OBJ') <'/kh.expect'>}
        )
        (C {<fail>} {(DQ <'remove wildcard'>)})
      ]
    )
    (C {<cp>} {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts.orig'>} 
      {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts'>}
    )
    (command.Simple
      words: [
        {(${ Id.VSub_Name SSHKEYGEN)}
        {<-qf>}
        {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts'>}
        {<-R>}
        {<host-h>}
      ]
      redirects: [(redir op:<Id.Redir_Great '2>'> loc:(redir_loc.Fd fd:2) arg:{<'/dev/null'>})]
      do_fork: T
    )
    (command.Simple
      words: [{<grep>} {<-v>} {(DQ <'^host-f,'>)} {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts.orig'>}]
      redirects: [
        (redir
          op: <Id.Redir_Great '>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/kh.expect'>}
        )
      ]
      do_fork: T
    )
    (command.AndOr
      ops: [Id.Op_DPipe]
      children: [
        (C {<diff>} {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts'>} 
          {($ Id.VSub_DollarName '$OBJ') <'/kh.expect'>}
        )
        (C {<fail>} {(DQ <'remove wildcard'>)})
      ]
    )
    (C {<cp>} {($ Id.VSub_DollarName '$OBJ') <'/kh.invalid.orig'>} 
      {($ Id.VSub_DollarName '$OBJ') <'/kh.invalid'>}
    )
    (command.AndOr
      ops: [Id.Op_DAmp]
      children: [
        (command.Simple
          words: [
            {(${ Id.VSub_Name SSHKEYGEN)}
            {<-qf>}
            {($ Id.VSub_DollarName '$OBJ') <'/kh.invalid'>}
            {<-H>}
          ]
          redirects: [(redir op:<Id.Redir_Great '2>'> loc:(redir_loc.Fd fd:2) arg:{<'/dev/null'>})]
          do_fork: T
        )
        (C {<fail>} {(DQ <'hash invalid succeeded'>)})
      ]
    )
    (command.AndOr
      ops: [Id.Op_DPipe]
      children: [
        (C {<diff>} {($ Id.VSub_DollarName '$OBJ') <'/kh.invalid'>} 
          {($ Id.VSub_DollarName '$OBJ') <'/kh.invalid.orig'>}
        )
        (C {<fail>} {(DQ <'invalid file modified'>)})
      ]
    )
    (C {<cp>} {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts.orig'>} 
      {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts'>}
    )
    (command.AndOr
      ops: [Id.Op_DPipe]
      children: [
        (command.Simple
          words: [
            {(${ Id.VSub_Name SSHKEYGEN)}
            {<-qf>}
            {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts'>}
            {<-H>}
          ]
          redirects: [(redir op:<Id.Redir_Great '2>'> loc:(redir_loc.Fd fd:2) arg:{<'/dev/null'>})]
          do_fork: T
        )
        (C {<fail>} {(DQ <'hash failed'>)})
      ]
    )
    (command.AndOr
      ops: [Id.Op_DPipe]
      children: [
        (C {<diff>} {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts.old'>} 
          {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts.orig'>}
        )
        (C {<fail>} {(DQ <'backup differs'>)})
      ]
    )
    (command.AndOr
      ops: [Id.Op_DAmp]
      children: [
        (C {<grep>} {(DQ <'^host-[abfgh]'>)} {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts'>})
        (C {<fail>} {(DQ <'original hostnames persist'>)})
      ]
    )
    (C {<cp>} {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts'>} 
      {($ Id.VSub_DollarName '$OBJ') <'/kh.hashed.orig'>}
    )
    (C {<rm>} {<-f>} {($ Id.VSub_DollarName '$OBJ') <'/kh.expect'>})
    (C {<expect_key>} {<host-a>} {<host-a>} {<host-a>})
    (C {<expect_key>} {<host-a>} {<host-a>} {<host-a2>})
    (C {<check_hashed_find>} {<host-a>} {(DQ <'find simple in hashed'>)} 
      {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts'>}
    )
    (C {<rm>} {<-f>} {($ Id.VSub_DollarName '$OBJ') <'/kh.expect'>})
    (C {<expect_key>} {<host-h>} {<host-h>} {<host-f>})
    (C {<check_hashed_find>} {<host-h>} {(DQ <'find simple in hashed'>)} 
      {($ Id.VSub_DollarName '$OBJ') <'/kh.hosts'>}
    )
    (C {<cp>} {($ Id.VSub_DollarName '$OBJ') <'/kh.hashed.orig'>} 
      {($ Id.VSub_DollarName '$OBJ') <'/kh.hashed'>}
    )
    (command.Simple
      words: [
        {(${ Id.VSub_Name SSHKEYGEN)}
        {<-qf>}
        {($ Id.VSub_DollarName '$OBJ') <'/kh.hashed'>}
        {<-R>}
        {<host-a>}
      ]
      redirects: [(redir op:<Id.Redir_Great '2>'> loc:(redir_loc.Fd fd:2) arg:{<'/dev/null'>})]
      do_fork: T
    )
    (command.AndOr
      ops: [Id.Op_DAmp]
      children: [
        (C {(${ Id.VSub_Name SSHKEYGEN)} {<-qf>} {($ Id.VSub_DollarName '$OBJ') <'/kh.hashed'>} {<-F>} 
          {<host-a>}
        )
        (C {<fail>} {(DQ <'found key after hashed remove'>)})
      ]
    )
  ]
)