anchor.diff:            not match their keyring password, Gnome Keyring will prompt separately
             after login.
           '';
  +      };
  +
  +      failDelay = {
  +        enable = mkOption {
  +          type = types.bool;
  +          default = false;
  +          description = lib.mdDoc ''
  +            If enabled, this will replace the `FAIL_DELAY` setting from `login.defs`.
  +            Change the delay on failure per-application.
  +            '';
  +        };
  +
  +        delay = mkOption {
  +          default = 3000000;
  +          type = types.int;
  +          example = 1000000;
  +          description = lib.mdDoc "The delay time (in microseconds) on failure.";
  +        };
         };
   
         gnupg = {
  
positive.code:               || cfg.enableGnomeKeyring
                || cfg.googleAuthenticator.enable
                || cfg.gnupg.enable
                || cfg.duoSecurity.enable))
              (
                ''
  
negative.code:               '' +
                optionalString cfg.gnupg.enable ''
                  auth optional ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so ${optionalString cfg.gnupg.storeOnly " store-only"}
                '' +
                optionalString cfg.failDelay.enable ''
                  auth optional ${pkgs.pam}/lib/security/pam_faildelay.so delay=${toString cfg.failDelay.delay}
                '' +
                optionalString cfg.googleAuthenticator.enable ''
                  auth required ${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so no_increment_hotp
  