anchor.diff:  
                   Be aware that these will be written to the nix store
                   in plaintext!
  +
  +                Mutually exclusive with <varname>pskRaw</varname>.
  +              '';
  +            };
  +
  +            pskRaw = mkOption {
  +              type = types.nullOr types.str;
  +              default = null;
  +              description = ''
  +                The network's pre-shared key in hex defaulting
  +                to being a network without any authentication.
  +
  +                Mutually exclusive with <varname>psk</varname>.
                 '';
               };
             };
  
positive.code:     ${optionalString cfg.userControlled.enable ''
        ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=${cfg.userControlled.group}
        update_config=1''}
      ${concatStringsSep "\n" (mapAttrsToList (ssid: networkConfig: ''
        network={
          ssid="${ssid}"
          ${optionalString (networkConfig.psk != null) ''psk="${networkConfig.psk}"''}
          ${optionalString (networkConfig.psk == null) ''key_mgmt=NONE''}
        }
      '') cfg.networks)}
    '' else "/etc/wpa_supplicant.conf";
  
negative.code: 
    config = mkMerge [
      (mkIf cfg.enable {
        assertions = flip mapAttrsToList cfg.networks (name: cfg: {
          assertion = cfg.psk == null || cfg.pskRaw == null;
          message = ''networking.wireless."${name}".psk and networking.wireless."${name}".pskRaw are mutually exclusive'';
        });
  
        environment.systemPackages =  [ pkgs.wpa_supplicant ];
  
        services.dbus.packages = [ pkgs.wpa_supplicant ];
  