VLAN configuration: netplan bad

network:
  version: 2
  renderer: networkd

  ethernets:
    enp3s0:
      # udev is confused on this system
      #
      match:
        macaddress: e0:d5:5e:2f:ee:3a

      # delay boot if this crucial internal interface is down
      #
      optional: false

      # Merlot provides DHCP Services on this interface
      #
      dhcp4: false
      dhcp6: false
      accept-ra: false

      # Infrastructure      Vlan 3  subnet 253
      #
      addresses:
        - 10.1.253.153/24
        - 2401:a400:4503:5820:253::153/80

      # very few explicit routes are needed
      # because the ip4 routes are implicit above,
      # but the individual ip6 subnets are all /80
      #
      routes:
        # for the moment, define our entire ip6 delegated prefix on merlot
        #
        - to:  2401:a400:4503:5820::/60
          via: 2401:a400:4503:5820:253::1

        # ip6 default route must not depend on enp2s0 being up...
        #
        - to:  "::0/0"
          via: 2401:a400:4503:5820:253::1

      nameservers:
          search: [ pingtoo.com ]
          addresses: [ "10.1.253.11", "2401:a400:4503:5820:253::11" ]


  # define the vlans at the same level as ethernets key above
  #
  vlans:

    # membership on the unsafe 802.1Q VLAN
    #
    usafe:

      # assign the VLAN identity number
      #
      id: 4

      # select the underlying real device for this virtual interface
      #
      link: enp3s0

      addresses:
        - 10.1.250.153/24
        - 2401:a400:4504:5820:250::153/80

      routes:
        - to: 2401:a400:4503:5820:250::/80
          via: 2401:a400:4503:5820:250::1
          on-link: true