Now I have investigated the problem further. My findings here: 1) The per-user layout influences the console layout when there is only one user. This in itself is somewhat reasonable, if little confusing to someone who has used to the old UNIX model that normal user cannot edit system-wide settings. 2) What is written in above propagates to the LUKS passphrase prompt only when the initrd regeneration is triggered, e. g. after kernel upgrade. The prompt does not echo the passphrase, nor does not show the keyboard layout that is being used. 3) If user selects an "extra" keyboard layout after enabling them in GNOME by running "gsettings set org.gnome.desktop.input-sources show-all-sources true", it will will propagate to the console properly, but NOT to the GDM. This makes it even more confusing. 4) By using auditd, I have determined that the process editing the /etc/default/keyboard is systemd-localed.
