ssh-agent: use types.nullOr