@jimis consistency and predictability; we're trying to keep settings the user needs to change often in `def.cf`.  The alternative is to make `trustkeysfrom` simply use `@(def.acl)`.  Then there is only one setting to modify.  But it seemed like there was some benefit to decoupling the two settings, from your original request.