start ks early (fixes encryption issues)