Squash some scan-build diagnostics
Notes on some spurious(?) valgrind diagnostics
Don't try to decrypt unsupported geli versions

Version 7 is in the wild (at least in FreeBSD 10) and it changed something
about encryption that isn't handled yet:
    http://svnweb.freebsd.org/base?view=revision&revision=238116
presumably earlier versions have other differences I haven't accounted for,
so don't try to read them either.
note version number restriction, update note about invocation