anchor.diff:        label = mkOption {
           default = null;
           example = "rootfs";
  -        type = types.nullOr types.str;
  -        description = "Label of the backing encrypted device.";
  +        type = types.uniq (types.nullOr types.str);
  +        description = "Label of the unlocked encrypted device. Set <literal>fileSystems.&lt;name?&gt;.device</literal> to <literal>/dev/mapper/&lt;label&gt;</literal> to mount the unlocked device.";
         };
   
         keyFile = mkOption {
           default = null;
           example = "/root/.swapkey";
           type = types.nullOr types.str;
  -        description = "File system location of keyfile.";
  +        description = "File system location of keyfile. This unlocks the drive after the root has been mounted to <literal>/mnt-root</literal>.";
         };
       };
     };
  
positive.code:     boot.initrd = {
        luks = {
          devices =
            map (dev: { name = dev.encrypted.label; device = dev.encrypted.blkDev; } ) encDevs;
          cryptoModules = [ "aes" "sha256" "sha1" "xts" ];
        };
        postMountCommands =
          concatMapStrings (dev: "cryptsetup luksOpen --key-file ${dev.encrypted.keyFile} ${dev.encrypted.label};\n") keyedEncDevs;
      };
    };
  }
  
negative.code:   fileSystems = attrValues config.fileSystems ++ config.swapDevices;
    encDevs = filter (dev: dev.encrypted.enable) fileSystems;
    keyedEncDevs = filter (dev: dev.encrypted.keyFile != null) encDevs;
    keylessEncDevs = filter (dev: dev.encrypted.keyFile == null) encDevs;
    isIn = needle: haystack: filter (p: p == needle) haystack != [];
    anyEncrypted =
      fold (j: v: v || j.encrypted.enable) false encDevs;
  