How to register multiple FIDO2 devices for a LUKS partition

Help
1

Hello,

I’ve been playing around with setting up a LUKS partition and I’ve succeeded in having a working setup.
But now, I would like to add an additional FIDO2 device for in case I lose my primary device.
I’ve tried searching and reading online, but haven’t found anything in relation to this.

Here is my current setup:

I used Disko to do the initial partitioning

luks = {
  size = "100%";
  content = {
    type = "luks";
    name = "nvme0n1p3_encrypted";
    settings = {
      allowDiscards = true;
    };
    passwordFile = "/tmp/secret.key";
    content = {
      type = "zfs";
      pool = "gnix";
    };
  };
};

You can see the full config here: nixos-config/hosts/gnix/disk-configuration.nix at 7b447c707cc793cb2acc276b2f4de622aac979a5 · moleculezz/nixos-config · GitHub

And my NixOS configuration is as follows:

boot.initrd = {
  systemd.enable = true;  # initrd uses systemd
  luks.fido2Support = false;  # because systemd
  luks.devices.nvme0n1p3_encrypted = {
    device = "/dev/disk/by-partlabel/disk-nvme-luks";
    crypttabExtraOpts = ["fido2-device=auto"];  # cryptenroll
  };
};

Then after first boot I ran:
sudo systemd-cryptenroll --fido2-device=auto /dev/nvme0n1p3

I tried connecting my other FIDO2 device and running the same command as I did with the other one, and I fill in the initial passwordFile I used when I created the first one, but I get an error that the password is incorrect. I would assume that the new credentials is the primary FIDO2 key, but how do I use the primary device to add another device?