diff --git a/TODO b/TODO
index b59ba01208..73af97d6c0 100644
--- a/TODO
+++ b/TODO
@@ -53,6 +53,12 @@ Features:
 
 * Maybe expose path_is_encrypted() as a new ConditionPathIsEncrypted=?
 
+* homed: as an extension to the directory+subvolume backend: if located on
+  especially marked fs, then sync down password into LUKS header of that fs,
+  and always verify passwords against it too. Bootstrapping is a problem
+  though: if noone is logged in (or no other user even exists yet), how do you
+  unlock the volume in order to create the first user and add the first pw.
+
 * busctl: maybe expose a verb "ping" for pinging a dbus service to see if it
   exists and responds.