Don't include vt-gpg when the keyvault is disabled.

It will still be on the node (due to the metadata dependency), but we
shouldn't use it.