diff --git a/ssh/knownhosts/knownhosts.go b/ssh/knownhosts/knownhosts.go
index fe9768a..66bb425 100644
--- a/ssh/knownhosts/knownhosts.go
+++ b/ssh/knownhosts/knownhosts.go
@@ -367,19 +367,19 @@ func (db *hostKeyDB) checkAddrs(addrs []addr, remoteKey ssh.PublicKey) error {
 	// hostname?
 
 	// Algorithm => key.
-	knownKeys := map[string]*KnownKey{}
+	knownKeys := map[string]KnownKey{}
 	for _, l := range db.lines {
 		if l.match(addrs) {
 			typ := l.knownKey.Key.Type()
 			if _, ok := knownKeys[typ]; !ok {
-				knownKeys[typ] = &l.knownKey
+				knownKeys[typ] = l.knownKey
 			}
 		}
 	}
 
 	keyErr := &KeyError{}
 	for _, v := range knownKeys {
-		keyErr.Want = append(keyErr.Want, *v)
+		keyErr.Want = append(keyErr.Want, v)
 	}
 
 	// Unknown remote host.
@@ -389,7 +389,7 @@ func (db *hostKeyDB) checkAddrs(addrs []addr, remoteKey ssh.PublicKey) error {
 
 	// If the remote host starts using a different, unknown key type, we
 	// also interpret that as a mismatch.
-	if known := knownKeys[remoteKey.Type()]; known == nil || !keyEq(known.Key, remoteKey) {
+	if known, ok := knownKeys[remoteKey.Type()]; !ok || !keyEq(known.Key, remoteKey) {
 		return keyErr
 	}
 
diff --git a/ssh/knownhosts/knownhosts_test.go b/ssh/knownhosts/knownhosts_test.go
index cffd72a..2d0834b 100644
--- a/ssh/knownhosts/knownhosts_test.go
+++ b/ssh/knownhosts/knownhosts_test.go
@@ -141,7 +141,7 @@ func TestIPv6Address(t *testing.T) {
 }
 
 func TestBasic(t *testing.T) {
-	str := fmt.Sprintf("#comment\n\nserver.org,%s %s", testAddr, edKeyStr)
+	str := fmt.Sprintf("#comment\n\nserver.org,%s %s\notherhost %s", testAddr, edKeyStr, ecKeyStr)
 	db := testDB(t, str)
 	if err := db.check("server.org:22", testAddr, edKey); err != nil {
 		t.Errorf("got error %q, want none", err)