anchor.diff:                fsType = mkOption {
                   default = "vfat";
                   type = types.string;
  -                description = "The filesystem of the unencrypted device";
  +                description = "The filesystem of the unencrypted device.";
                 };
   
                 mountPoint = mkOption {
                   default = "/crypt-storage";
                   type = types.string;
  -                description = "Path where the unencrypted device will be mounted in stage-1";
  +                description = "Path where the unencrypted device will be mounted during early boot.";
                 };
   
                 path = mkOption {
  
positive.code:         $out/bin/ykchalresp -V
          $out/bin/ykinfo -V
          cat > $out/bin/openssl-wrap <<EOF
  #!$out/bin/sh
  export OPENSSL_CONF=$out/etc/ssl/openssl.cnf
  $out/bin/openssl "\$@"
  EOF
          $out/bin/openssl-wrap version
        ''}
      '';
  
negative.code:             twoFactor = mkOption {
                default = true;
                type = types.bool;
                description = "Whether to use a passphrase and a Yubikey (true), or only a Yubikey (false).";
              };
  
              slot = mkOption {
                default = 2;
                type = types.int;
                description = "Which slot on the Yubikey to challenge.";
              };
  
              saltLength = mkOption {
                default = 16;
                type = types.int;
                description = "Length of the new salt in byte (64 is the effective maximum).";
              };
  
              keyLength = mkOption {
                default = 64;
                type = types.int;
                description = "Length of the LUKS slot key derived with PBKDF2 in byte.";
              };
  
              iterationStep = mkOption {
                default = 0;
                type = types.int;
                description = "How much the iteration count for PBKDF2 is increased at each successful authentication.";
              };
  
              gracePeriod = mkOption {
                default = 2;
                type = types.int;
                description = "Time in seconds to wait before attempting to find the Yubikey.";
              };
  
              ramfsMountPoint = mkOption {
                default = "/crypt-ramfs";
                type = types.string;
                description = "Path where the ramfs used to update the LUKS key will be mounted during early boot.";
              };
  
              /* TODO: Add to the documentation of the current module:
  