@ParadeGrotesque interesting, thanks!
However, they state clearly it won't work on OpenBSD :flan_aw:
> Other BSD variants, such as OpenBSD and NetBSD, are unsupported as they have a severe limitation over the maximum number of supplementary groups, causing problems for group membership and restricted commands checks, as well as no filesystem-level ACL support and missing PAM support (hence no MFA).