And the usbguard must be installed in the initramfs, not the main system, right? Because the fde password is provided before most of the system loads.