ssh bug fix

doc/CHANGELOG.md

@@ -152,6 +152,15 @@ Versions follow `MAJOR.MINOR.PATCH-REVISION_STAGE_N` (e.g. `3.99.1-4_rc_1`).
   silent white, a null speed no longer spins the CPU, a non-terminal stdin or
   stdout is refused instead of looping, and the usage mentions `q` to quit;
   README defaults of the `[rain]` keys corrected.
+- `ssh.sh`: `rmhost` with a wildcard that matched nothing tried to remove an
+  empty host name; it removed only the first IP of a name (all addresses are
+  now handled); `[host]:port` arguments were taken for glob patterns; each
+  match was removed from every file with warnings for the others (now per
+  file); with `--all-users`, `ssh-keygen` left other users' files owned by
+  root (owner and mode are restored) and a shared home directory was
+  processed twice; `@cert-authority` lines are never touched. `ssr` ignored an
+  empty `SSH_DEFAULT_OPT` (documented as "no option") and now rejects an
+  option given in place of the server.
 - `compress.sh`: option flags and loop variables no longer leak into the
   interactive shell.