-d16_cmdline="console=ttyS0,115200n8 pci=realloc=off console=tty0"
-d16_cmdline="pci=realloc=off console=tty0"
+
+# we make tty0 the last one so that it gets /dev/console and then
+# debian's cryptsetup addition askpass prompts there in the initramfs.
+# todo: file a bug to make it prompt on both.
+d16_cmdline="pci=realloc=off console=ttyS0,115200n8 console=tty0"