* Prefer the openssh-portable port, but fall back to the base
  version if it is available.

* Refactor the key generation to produce less duplicated code.

* Locking is completely bogus, but I have no clue how to fix
  that short term without doing a full audit of the subsystem-dirty
  mechanic.