anchor.diff:  
     config = mkMerge [
       (mkIf cfg.enable {
  +      assertions = flip mapAttrsToList cfg.networks (name: cfg: {
  +        assertion = cfg.psk == null || cfg.pskRaw == null;
  +        message = ''networking.wireless."${name}".psk and networking.wireless."${name}".pskRaw are mutually exclusive'';
  +      });
  +
         environment.systemPackages =  [ pkgs.wpa_supplicant ];
   
         services.dbus.packages = [ pkgs.wpa_supplicant ];
  
positive.code:     ${optionalString cfg.userControlled.enable ''
        ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=${cfg.userControlled.group}
        update_config=1''}
      ${concatStringsSep "\n" (mapAttrsToList (ssid: networkConfig: ''
        network={
          ssid="${ssid}"
          ${optionalString (networkConfig.psk != null) ''psk="${networkConfig.psk}"''}
          ${optionalString (networkConfig.psk == null) ''key_mgmt=NONE''}
        }
      '') cfg.networks)}
    '' else "/etc/wpa_supplicant.conf";
  
negative.code: 
                  Be aware that these will be written to the nix store
                  in plaintext!
  
                  Mutually exclusive with <varname>pskRaw</varname>.
                '';
              };
  
              pskRaw = mkOption {
                type = types.nullOr types.str;
                default = null;
                description = ''
                  The network's pre-shared key in hex defaulting
                  to being a network without any authentication.
  
                  Mutually exclusive with <varname>psk</varname>.
                '';
              };
            };
  