Sécurix: the French state's hardened NixOS, where the password is only a fallback
The DINUM's SécurixOS is an alpha NixOS build for secure workstations: ANSSI hardening, a custom kernel, FIDO2 login and disk unlock, TPM2 and centralised Secure Boot, and age or Vault for secrets. It is MIT, it is not a fork, and it is not for everyone yet.