anchor.diff:                example = "f1d00200d8dc783f7fb1e10ace8da27f8312d72692abfca2f7e4960a73f48e82e1f7571f6ebfcee9fb434f9886ccc8fcc52a6614d8d2";
                 type = types.nullOr types.str;
                 description = lib.mdDoc "The FIDO2 credential ID.";
  +            };
  +
  +            credentials = mkOption {
  +              default = [];
  +              example = [ "f1d00200d8dc783f7fb1e10ace8da27f8312d72692abfca2f7e4960a73f48e82e1f7571f6ebfcee9fb434f9886ccc8fcc52a6614d8d2" ];
  +              type = types.listOf types.str;
  +              description = lib.mdDoc ''
  +                List of FIDO2 credential IDs.
  +
  +                Use this if you have multiple FIDO2 keys you want to use for the same luks device.
  +              '';
               };
   
               gracePeriod = mkOption {
  
positive.code:     }
      ''}
  
      ${optionalString (luks.fido2Support && (dev.fido2.credential != null)) ''
  
      open_with_hardware() {
        local passsphrase
  
negative.code:            + optionalString dev.bypassWorkqueues " --perf-no_read_workqueue --perf-no_write_workqueue"
             + optionalString (dev.header != null) " --header=${dev.header}";
      cschange = "cryptsetup luksChangeKey ${dev.device} ${optionalString (dev.header != null) "--header=${dev.header}"}";
      fido2luksCredentials = dev.fido2.credentials ++ optional (dev.fido2.credential != null) dev.fido2.credential;
    in ''
      # Wait for luksRoot (and optionally keyFile and/or header) to appear, e.g.
      # if on a USB drive.
  