allow-update { key host1-host2. ;};