virt: preapprove VM keys