does enabling boot.initrd.systemd.network somehow change where the authorized_keys file is stored when doing remote luks unlocking?
For example, the following config gives me the ssh error "Permission denied (publickey)":

  boot.initrd = {
  # Include necessary modules for networking and VLAN in initrd
    availableKernelModules = [
      "r8169"    # NIC driver
      "8021q"    # For VLAN support
    ];

    # Enable networking in initrd
    network.enable = true;

    # SSH for remote unlock
    # enable ssh during boot so we can decrypt disks
    # see https://nixos.wiki/wiki/Remote_disk_unlocking
    # NOTE: the ssh host keys during boot are different! We can ignore that temporarily as follows
    #   ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null root@<target_ip>
    #   cryptsetup-askpass          # will prompt to unlock disks
    # the intrd ssh then exits
    network.ssh = {
      enable = true;
      port = 22;
      authorizedKeys = config.users.users.root.openssh.authorizedKeys.keys;
      hostKeys = [ "/etc/secrets/initrd/ssh_host_ecdsa_key" ];
    };

    # Use systemd in initrd (enabled by default when network.enable = true)
    systemd.enable = true;

    # Configure systemd-networkd in initrd for VLAN 51 and DHCP
    systemd.network = {
      enable = true;

      netdevs = {
        "10-vlan51" = {
          netdevConfig = {
            Kind = "vlan";
            Name = "vlan51";
          };
          vlanConfig.Id = 51;
        };
      };

      networks = {
        # Physical interface in initrd (replace enp1s0 if needed)
        "10-phy" = {
          matchConfig.Name = "enp*s*";  # Match your interface pattern (e.g., enp1s0)
          networkConfig = {
            LinkLocalAddressing = "no";
            VLAN = [ "vlan51" ];
          };
        };

        # DHCP on VLAN 51
        "20-vlan51" = {
          matchConfig.Name = "vlan51";
          networkConfig = {
            DHCP = "yes";
          };
        };
      };
    };

    # Set shell for remote unlock
    systemd.users.root.shell = "/bin/cryptsetup-askpass";

  };

but I have confirmed with the nix repl that boot.initrd.network.ssh.authorizedKeys does in fact contain my public key.