anchor.diff:  
     config = mkIf (luks.devices != {} || luks.forceLuksSupportInInitrd) {
   
  +    assertions =
  +      [ { assertion = !(luks.gpgSupport && luks.yubikeySupport);
  +          message = "Yubikey and GPG Card may not be used at the same time.";
  +        }
  +      ];
  +
       # actually, sbp2 driver is the one enabling the DMA attack, but this needs to be tested
       boot.blacklistedKernelModules = optionals luks.mitigateDMAAttacks
         ["firewire_ohci" "firewire_core" "firewire_sbp2"];
  
positive.code:             open_normally
          fi
      }
  
      open_yubikey
      '' else ''
      open_normally
      ''}
  
negative.code:         umount /crypt-storage
      }
  
      open_with_hardware() {
          if wait_yubikey ${toString yubikey.gracePeriod}; then
              do_open_yubikey
          else
  