bacon: Relocate disk encryption metadata