> There was a time when the idea of spending an afternoon typing cryptsetup incantations into a terminal would have been appealing.

Oddly enough, I use NixOS as a network-disabled USB live image for handling my Yubikey, SSH, and GNUPG setup. I'm bashing cryptsetup all the time!