anchor.diff:          };
         };
       })
  +
  +    (mkIf cfg.enableExtraSocket {
  +      systemd.user.sockets.gpg-agent-extra = {
  +        Unit = {
  +          Description = "GnuPG cryptographic agent and passphrase cache (restricted)";
  +          Documentation = "man:gpg-agent(1) man:ssh(1)";
  +        };
  +
  +        Socket = {
  +          ListenStream = "%t/gnupg/S.gpg-agent.extra";
  +          FileDescriptorName = "extra";
  +          Service = "gpg-agent.service";
  +          SocketMode = "0600";
  +          DirectoryMode = "0700";
  +        };
  +
  +        Install = {
  +          WantedBy = [ "sockets.target" ];
  +        };
  +      };
  +    })
     ]);
   }
  
positive.code:         };
  
          Service = {
            ExecStart = "${pkgs.gnupg}/bin/gpg-agent --supervised";
            ExecReload = "${pkgs.gnupg}/bin/gpgconf --reload gpg-agent";
          };
        };
  
negative.code:         default = false;
          description = ''
            Whether to use the GnuPG key agent for SSH keys.
          '';
        };
  
        enableExtraSocket = mkOption {
          type = types.bool;
          default = false;
          description = ''
            Whether to enable extra socket of the GnuPG key agent (useful for GPG
            Agent forwarding).
          '';
        };
  
        verbose = mkOption {
          type = types.bool;
          default = false;
          description = ''
            Whether to produce verbose output.
          '';
        };
  
  