it would be way better to pass keyfile in commandline as `--keyfile ${keyfile}`, otherwise keyfile will endup in nix store readable to all users on the system.