Use tpm or yubikey in install phase

Is it possible to use the tpm or a yubikey during a package’s install phase? The following derivation was working before on nixos-26.05, but after updating the channel, it no longer seems to work, despite the age file still being decryptable outside of a build: pkgs.stdenvNoCC.mkDerivation { pname = "cartograph-cf-demibolditalic-otf-nerdfont"; version = "2.4"; dontUnpack = true; nativeBuildInputs = with pkgs; [ config.home-manager.users.root.age.package nerd-font-patcher ]; ...