Thanks for solving this so quickly, Colin! But doesn't need the `addgroup --system --quiet` also `--force-badname`, if the group name starts with an underscore? No harm done by `update_ssh_group_name()`, but maybe I would use `if ! getent group _ssh >/dev/null; then` instead of `if getent group ssh >/dev/null; then` just for the aesthetics (and to prevent postinst failure, in case both `ssh` and `_ssh` already exist).