in fact you can do it per-ssh-key