Move zncrypt setup to its own recipe