anchor.diff:      umount /crypt-ramfs 2>/dev/null
     '';
   
  -  openCommand = name': { name, device, header, keyFile, keyFileSize, keyFileOffset, allowDiscards, yubikey, gpgCard, fallbackToPassword, ... }: assert name' == name;
  +  openCommand = name': { name, device, header, keyFile, keyFileSize, keyFileOffset, allowDiscards, yubikey, gpgCard, fido2, fallbackToPassword, ... }: assert name' == name;
     let
       csopen   = "cryptsetup luksOpen ${device} ${name} ${optionalString allowDiscards "--allow-discards"} ${optionalString (header != null) "--header=${header}"}";
       cschange = "cryptsetup luksChangeKey ${device} ${optionalString (header != null) "--header=${header}"}";
  
positive.code:         $out/bin/gpg-agent --version
          $out/bin/scdaemon --version
        ''}
      '';
  
      boot.initrd.preFailCommands = postCommands;
  
negative.code:     assertions =
        [ { assertion = !(luks.gpgSupport && luks.yubikeySupport);
            message = "Yubikey and GPG Card may not be used at the same time.";
          }
  
          { assertion = !(luks.gpgSupport && luks.fido2Support);
            message = "FIDO2 and GPG Card may not be used at the same time.";
          }
  
          { assertion = !(luks.fido2Support && luks.yubikeySupport);
            message = "FIDO2 and Yubikey may not be used at the same time.";
          }
        ];
  
  