update cabal-install to 1.20
prune allowed ssh keys
more tarsnap exclude