diff --git a/cdist/conf/type/__ssh_authorized_key/deprecated b/cdist/conf/type/__ssh_authorized_key/deprecated
new file mode 100644
index 00000000..bf72faaa
--- /dev/null
+++ b/cdist/conf/type/__ssh_authorized_key/deprecated
@@ -0,0 +1 @@
+This type is deprecated. Please use __ssh_authorized_keys instead.
diff --git a/cdist/conf/type/__ssh_authorized_keys/gencode-remote b/cdist/conf/type/__ssh_authorized_keys/gencode-remote
new file mode 100755
index 00000000..2fb1895a
--- /dev/null
+++ b/cdist/conf/type/__ssh_authorized_keys/gencode-remote
@@ -0,0 +1,129 @@
+#!/bin/sh -e
+#
+# 2012-2014 Steven Armstrong (steven-cdist at armstrong.cc)
+# 2014 Nico Schottelius (nico-cdist at schottelius.org)
+# 2021 Darko Poljak (darko.poljak at gmail.com)
+#
+# This file is part of cdist.
+#
+# cdist is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# cdist is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with cdist. If not, see <http://www.gnu.org/licenses/>.
+#
+
+state="$(cat "$__object/parameter/state" 2>/dev/null)"
+file="$(cat "$__object/explorer/file")"
+keys_file="$__object/explorer/keys"
+
+temp_file="${file}.tmp"
+work_file="${temp_file}.work"
+
+_type_and_key() {
+    echo "$1" | tr ' ' '\n' | awk '/^(ssh|ecdsa)-[^ ]+/ { printf $1" "; getline; printf $1 }'
+}
+
+_gen_key_entry() {
+    _the_key="$1"
+    # generate the key entry as it should be
+    if [ -f "$__object/parameter/option" ]; then
+        # comma seperated list of options
+        options="$(tr '\n' ',' < "$__object/parameter/option")"
+        printf '%s ' "${options%*,}"
+    fi
+    if [ -f "$__object/parameter/comment" ]; then
+        # extract the keytype and base64 encoded key ignoring any options and comment
+        printf '%s ' "$(echo "${_the_key}" | tr ' ' '\n' | awk '/^(ssh|ecdsa)-[^ ]+/ { printf $1" "; getline; printf $1 }')"
+        # override the comment with the one explicitly given
+        printf '%s' "$(cat "$__object/parameter/comment")"
+    else
+        printf '%s' "${_the_key}"
+    fi
+    printf '\n'
+}
+
+cat << DONE
+cp -f "${file}" "${temp_file}"
+DONE
+
+while read -r key; do
+    # validate key
+    validated_key="$(echo "${key}" | tr ' ' '\n' | awk '/^(ssh|ecdsa)-[^ ]+/ { printf $1" "; getline; printf $1 }')"
+    if [ -z "${validated_key}" ]
+    then
+        echo "Key is invalid: \"${key}\"" >&2
+        exit 1
+    fi
+
+    type_and_key="$(_type_and_key "${key}")"
+
+    # remove conflicting entries
+    cat << DONE
+    grep -v "${type_and_key}\\([ \\n].*\\)*\$" "${temp_file}" > "${work_file}" || true
+DONE
+
+    entry="$(_gen_key_entry "${key}")"
+
+    case "${state}" in
+        present)
+            # escape single quotes
+            _line_sanitised=$(echo "${entry}" | sed -e "s/'/'\"'\"'/g")
+            cat << DONE
+            printf "%s\\n" "${_line_sanitised}" >> "${work_file}"
+            mv -f "${work_file}" "${temp_file}"
+DONE
+            echo "added to ${file} (${entry})" >> "$__messages_out"
+        ;;
+        absent)
+            cat << DONE
+            grep -v "${entry}" "${work_file}" > "${temp_file}" || true
+            rm -f "${work_file}"
+DONE
+            echo "removed from ${file} (${entry})" >> "$__messages_out"
+        ;;
+    esac
+done < "$__object/parameter/key"
+
+set --
+cat << DONE
+set --
+DONE
+if [ -f "$__object/parameter/remove-unknown" ] && [ -s "${keys_file}" ]
+then
+    while read -r key
+    do
+        type_and_key="$( _type_and_key "${key}" )"
+
+        if grep -Fq "${type_and_key}" "$__object/parameter/key"
+        then
+            continue
+        fi
+
+        # build grep -e patterns
+        set -- "\$@" "-e" "${key}"
+        cat << DONE
+        set -- "\$@" "-e" "${key}"
+DONE
+    done < "${keys_file}"
+
+    # if no pattern then nothing to remove
+    if [ $# -gt 0 ]
+    then
+        cat << DONE
+        grep -v -F -x "\$@" "${temp_file}" > "${work_file}" || true
+        mv -f "${work_file}" "${temp_file}"
+DONE
+    fi
+fi
+
+cat << DONE
+mv -f "${temp_file}" "${file}"
+DONE
diff --git a/cdist/conf/type/__ssh_authorized_keys/man.rst b/cdist/conf/type/__ssh_authorized_keys/man.rst
index dac6adeb..a2f7c1af 100644
--- a/cdist/conf/type/__ssh_authorized_keys/man.rst
+++ b/cdist/conf/type/__ssh_authorized_keys/man.rst
@@ -122,12 +122,13 @@ SEE ALSO
 
 AUTHORS
 -------
-Steven Armstrong <steven-cdist--@--armstrong.cc>
+| Steven Armstrong <steven-cdist--@--armstrong.cc>
+| Darko Poljak <darko.poljak--@--gmail.com>
 
 
 COPYING
 -------
-Copyright \(C) 2012-2014 Steven Armstrong. You can redistribute it
-and/or modify it under the terms of the GNU General Public License as
-published by the Free Software Foundation, either version 3 of the
+Copyright \(C) 2012-2021 Steven Armstrong and Darko Poljak. You can
+redistribute it and/or modify it under the terms of the GNU General Public
+License as published by the Free Software Foundation, either version 3 of the
 License, or (at your option) any later version.
diff --git a/cdist/conf/type/__ssh_authorized_keys/manifest b/cdist/conf/type/__ssh_authorized_keys/manifest
index b319316b..57056bd5 100755
--- a/cdist/conf/type/__ssh_authorized_keys/manifest
+++ b/cdist/conf/type/__ssh_authorized_keys/manifest
@@ -2,6 +2,7 @@
 #
 # 2012-2014 Steven Armstrong (steven-cdist at armstrong.cc)
 # 2014 Nico Schottelius (nico-cdist at schottelius.org)
+# 2021 Darko Poljak (darko.poljak at gmail.com)
 #
 # This file is part of cdist.
 #
@@ -20,80 +21,32 @@
 #
 
 owner="$(cat "$__object/parameter/owner" 2>/dev/null || echo "$__object_id")"
-state="$(cat "$__object/parameter/state" 2>/dev/null)"
 file="$(cat "$__object/explorer/file")"
 
-if [ ! -f "$__object/parameter/nofile" ] && [ -z "$file" ]
+if [ ! -f "$__object/parameter/nofile" ] && [ -z "${file}" ]
 then
-	echo "Cannot determine path of authorized_keys file" >&2
-	exit 1
+    printf "Cannot determine path of authorized_keys file\\n" >&2
+    exit 1
 fi
 
 if [ ! -f "$__object/parameter/noparent" ] || [ ! -f "$__object/parameter/nofile" ]; then
-   group="$(cut -d':' -f 1 "$__object/explorer/group")"
-   if [ -z "$group" ]; then
-      echo "Failed to get owners group from explorer." >&2
-      exit 1
-   fi
+    group="$(cut -d':' -f 1 "$__object/explorer/group")"
+    if [ -z "${group}" ]; then
+        printf "Failed to get owners group from explorer\\n" >&2
+        exit 1
+    fi
 
-   if [ ! -f "$__object/parameter/noparent" ]; then
-      __ssh_dot_ssh "$owner"
-      export require="__ssh_dot_ssh/$owner"
-   fi
-   if [ ! -f "$__object/parameter/nofile" ]; then
-      # Ensure that authorized_keys file exists and has the right permissions.
-      __file "$file" \
-         --owner "$owner" \
-         --group "$group" \
-         --mode 0600 \
-         --state exists
-      export require="__file/$file"
-   fi
-fi
-
-_cksum() {
-   echo "$1" | cksum | cut -d' ' -f 1
-}
-
-_type_and_key() {
-   echo "$1" | tr ' ' '\n' | awk '/^(ssh|ecdsa)-[^ ]+/ { printf $1" "; getline; printf $1 }'
-}
-
-while read -r key; do
-   type_and_key="$( _type_and_key "$key" )"
-   object_id="$(_cksum "$file")-$(_cksum "$type_and_key")"
-   set -- "$object_id"
-   set -- "$@" --file "$file"
-   set -- "$@" --key "$key"
-   set -- "$@" --state "$state"
-   if [ -f "$__object/parameter/option" ]; then
-      # shellcheck disable=SC2046
-      set -- "$@" $(printf -- '--option %s ' $(cat "$__object/parameter/option"))
-   fi
-   if [ -f "$__object/parameter/comment" ]; then
-      set -- "$@" --comment "$(cat "$__object/parameter/comment")"
-   fi
-   # Ensure __ssh_authorized_key does not read stdin
-   __ssh_authorized_key "$@" < /dev/null
-done < "$__object/parameter/key"
-
-if [ -f "$__object/parameter/remove-unknown" ] &&
-    [ -s "$__object/explorer/keys" ]
-then
-    while read -r key
-    do
-        type_and_key="$( _type_and_key "$key" )"
-
-        if grep -Fq "$type_and_key" "$__object/parameter/key"
-        then
-            continue
-        fi
-
-        __ssh_authorized_key "remove-$( _cksum "$file$key" )" \
-            --file "$file" \
-            --key "$key" \
-            --state absent \
-                < /dev/null
-    done \
-        < "$__object/explorer/keys"
+    if [ ! -f "$__object/parameter/noparent" ]; then
+        __ssh_dot_ssh "${owner}"
+        export require="__ssh_dot_ssh/${owner}"
+    fi
+    if [ ! -f "$__object/parameter/nofile" ]; then
+        # Ensure that authorized_keys file exists and has the right permissions.
+        __file "${file}" \
+            --owner "${owner}" \
+            --group "${group}" \
+            --mode 0600 \
+            --state exists
+        export require="__file/${file}"
+    fi
 fi