{
  security.pam = {
    p11.enable = false;
    p11.control = "sufficient";
    u2f.enable = true;
    u2f.settings.cue = true;
    sshAgentAuth.enable = false;
  };
}