OptionalinsecurePer-device TLS / SSH host-key trust opt-out (insecure=), boolean.
OptionalportOptionalsourceIdentity-source hint (e.g. arp); parsed but not consumed yet.
OptionalsshPer-device SSH private-key path (ssh-key=), raw string (path only).
OptionaltimeoutOptionalvalidateOptionalvia
Comment-kv overrides, coerced and tagged with
comment-kvprovenance.