NSS ended up being required. PKG_CHECK_MODULES need an action-if-not-found
be it just a no-op.