remote/(un)lock shouldn't require trusted nis