meh… after a lot of poking around (take out and plug back the nk3, restarting daemons and keepassxc…) it finally worked… so I guess all the parts are there, just that I don’t fully understand how I eventually bashed them into a working state.
The last thing I did before it started working was to enable pcsc-spy on keepassxc pcsc-spy(1) — Arch manual pages