* Sane defaults like FreeBSD: off, no root login, no passwords.

* Fix a bug in <sshdkeyonly/> handling.  Yes, it has been broken for
  ages.