Unpin nixpkgs here. Consider ZKAPAuthorizer a library and let the integrator pin a version. This is probably not the final word on how things should work but it helps for now.
Downgrade the Python module typing to a version compatible with Hypothesis.
Bump to a version of LeastAuthority/privacypass that doesn't require us to use Git submodules (which introduce an extra place for weird confusion in the packaging)
Bump to the latest Tahoe-LAFS integration branch revision and add setuptools as an explicit runtime dependency (because it is one now)