How best to set host key in vm

[George myglc2 Clemmer]

I want to set the host key in 'guix system vm-image' so that updating a
VM config does not break that VM's host key entry in my client machine
~/.ssh/knownhosts files.  AFAIK there is no direct way to do this. I
tried this ...

  (services (cons*
  [...]
             (extra-special-file "/etc/ssh/ssh_host_ed25519_key"
                                 (local-file "ssh_host_ed25519_key"))
             (extra-special-file "/etc/ssh/ssh_host_ed25519_key.pub"
                                 (local-file "ssh_host_ed25519_key.pub"))
  )

... which does work but naturally throws errors ...

localhost sshd[236]: error: 
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
localhost sshd[236]: error: @         WARNING: UNPROTECTED PRIVATE KEY FILE!    
      @
localhost sshd[236]: error: 
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
localhost sshd[236]: error: Permissions 0444 for 
'/etc/ssh/ssh_host_ed25519_key' are too open.
localhost sshd[236]: error: It is required that your private key files are NOT 
accessible by others.
localhost sshd[236]: error: This private key will be ignored.
localhost sshd[236]: error: key_load_private: bad permissions localhost 
sshd[236]: error: Could not load host key:/etc/ssh/ssh_host_ed25519_key
localhost sshd[236]: Accepted publickey for g1 from 192.168.1.14 port 56311 
ssh2: RSA SHA256:RAXP4+5SU3UN09NL+QwkQmAsLIoDa8Wq6Bi61DzUScY

When I specifyed only the public key, new private and public keys were
generated by, I guess, the first boot.

Suggestions? TIA - George