anchor.diff:        <listitem><para><literal>always</literal> causes certificate payloads to be sent
         unconditionally whenever certificate authentication is used.</para></listitem>
         </itemizedlist>
  +    '';
  +
  +    ppk_id = mkOptionalStrParam ''
  +       String identifying the Postquantum Preshared Key (PPK) to be used.
  +    '';
  +
  +    ppk_required = mkYesNoParam no ''
  +       Whether a Postquantum Preshared Key (PPK) is required for this connection.
       '';
   
       keyingtries = mkIntParam 1 ''
  
positive.code:         supported, but the installation does not fail otherwise.
        '';
  
        start_action = mkEnumParam ["none" "trap" "start"] "none" ''
          Action to perform after loading the configuration.
          <itemizedlist>
  
negative.code:         <literal>0xffffffff</literal>.
        '';
  
        set_mark_in = mkStrParam "0/0x00000000" ''
          Netfilter mark applied to packets after the inbound IPsec SA processed
          them. This way it's not necessary to mark packets via Netfilter before
          decryption or right afterwards to match policies or process them
          differently (e.g. via policy routing).
  
          An additional mask may be appended to the mark, separated by
          <literal>/</literal>. The default mask if omitted is 0xffffffff. The
          special value <literal>%same</literal> uses the value (but not the mask)
          from <option>mark_in</option> as mark value, which can be fixed,
          <literal>%unique</literal> or <literal>%unique-dir</literal>.
  
          Setting marks in XFRM input requires Linux 4.19 or higher.
        '';
  
        set_mark_out = mkStrParam "0/0x00000000" ''
          Netfilter mark applied to packets after the outbound IPsec SA processed
          them. This allows processing ESP packets differently than the original
          traffic (e.g. via policy routing).
  
          An additional mask may be appended to the mark, separated by
          <literal>/</literal>. The default mask if omitted is 0xffffffff. The
          special value <literal>%same</literal> uses the value (but not the mask)
          from <option>mark_out</option> as mark value, which can be fixed,
          <literal>%unique_</literal> or <literal>%unique-dir</literal>.
  
          Setting marks in XFRM output is supported since Linux 4.14. Setting a
          mask requires at least Linux 4.19.
        '';
  
        tfc_padding = mkParamOfType (with lib.types; either int (enum ["mtu"])) 0 ''
          Pads ESP packets with additional data to have a consistent ESP packet
          size for improved Traffic Flow Confidentiality. The padding defines the
  