allow ssh keys to be specified by group as well as by explicit list

This is intended to be a backwards compatible change (if we find an array instead of a hash, treat that array as a list of users)