Fix ChangePassphrase for locked manager.

Since the manager now allows the private password to be changed while it's
locked, the crypto keys need to be decrypted before reencrypting them.
Otherwise it's just encrypting zeros.

Found by tests.