anchor.diff:  not.)
   
   Encrypted boxes on the system fundamentally come in two forms -- there's
  -the boxes associated with the zpool (one set for the primary Yubikey and
  +the boxes associated with the zpool (one set for the primary YubiKey and
   one set for recovery), and then there are boxes for each of the keys
   stored by the RFD77 soft-token (recall that the soft-token individually
   encrypts its keys even when zpool encryption is enabled, as part of the
  
positive.code: 
  Some tokens have extensions that allow for attestation -- that is a method
  to show that a given key was created by the device and was not imported onto
  the PIV token. For Yubikeys, this is done by creating a special x509 certificate
  as detailed {yubi-attest}[here].
  
  If an operator wishes to require attestation, they must set the
  
negative.code: sets the SAPI parameter `KBMAPI_REQUIRE_TOKEN_PRELOAD` to `true`.  A command
  line tool (working name `kbmctl`) is then used by the operator to load the
  range of serial numbers into KBMAPI.  This is only supported for tokens that
  support attestation (e.g. YubiKeys).  In other words, enabling
  `KBMAPI_REQUIRE_TOKEN_PRELOAD` requires `KBMAPI_REQUIRE_ATTESTATION` to also
  be enabled (but not necessarily vice versa).
  
  