(In reply to Fabian Vogt from comment #1) > I see that /usr/lib/pam.d/login has pam_keyinit.so before common-session, > while /etc/pam.d/sddm has it the other way around. Maybe that makes a > difference? It looks like the common usage on various distros is: session required pam_loginuid.so session optional pam_keyinit.so ... session include common-session