enroll wf: fix location of key check