hosts:
let
  optional = attrset: val: if attrset ? ${val} then [ attrset.${val} ] else [ ];

  mkPubkeys = host: optional host "pubkey" ++ optional host "owner";

  op =
    acc: host:
    acc
    // (builtins.listToAttrs (
      map (file: {
        name = "${host}/${file}";
        value = {
          publicKeys = mkPubkeys hosts.${host};
        };
      }) hosts.${host}.files
    ));
in
builtins.foldl' op { } (builtins.attrNames hosts)