Originally, the idea was to have pam-pin as an optional module in gdm-password,
but since the PIN can easily get misconfigured, what we want here is
to give the user a choice at the login screen, so we want two different
conversations at the same time.
The pin module is marked requisite, so if it fails we stop before touching
the other modules and immediately report to the greeter (which then goes
on with gdm-password)