(In reply to Franck Bui from comment #33) > > Does that sound correct ? Yes, except ... > But it would be better if we could integrate pam_keyinit.so. I hesitate to say "better". One can argue that it worked so far without any explicit integration and justification for such serious change in systemd is rather weak (are you aware of any service that actually makes use of invocation ID?). Alternative is to explicitly pass invocation IDs on those services that really need it.