bcfg2-crypt: backported fixes in b5b26415161e715fe4d22d69328b06801ff7124d