anchor.diff:            echo "Please move your mouse to create needed randomness."
           ''}
             echo "Waiting for your FIDO2 device..."
  -          fido2luks open${optionalString dev.allowDiscards " --allow-discards"} ${dev.device} ${dev.name} ${dev.fido2.credential} --await-dev ${toString dev.fido2.gracePeriod} --salt string:$passphrase
  +          fido2luks open${optionalString dev.allowDiscards " --allow-discards"} ${dev.device} ${dev.name} "${builtins.concatStringsSep "," fido2luksCredentials}" --await-dev ${toString dev.fido2.gracePeriod} --salt string:$passphrase
           if [ $? -ne 0 ]; then
             echo "No FIDO2 key found, falling back to normal open procedure"
             open_normally
  
positive.code:               example = "f1d00200d8dc783f7fb1e10ace8da27f8312d72692abfca2f7e4960a73f48e82e1f7571f6ebfcee9fb434f9886ccc8fcc52a6614d8d2";
                type = types.nullOr types.str;
                description = lib.mdDoc "The FIDO2 credential ID.";
              };
  
              gracePeriod = mkOption {
  
negative.code:     # commands to run right before we mount our device
      ${dev.preOpenCommands}
  
      ${if (luks.yubikeySupport && (dev.yubikey != null)) || (luks.gpgSupport && (dev.gpgCard != null)) || (luks.fido2Support && fido2luksCredentials != []) then ''
      open_with_hardware
      '' else ''
      open_normally
  