m4: store encryption keys in the "extra" partition
m4: don't mount anything in /data

Otherwise, encryption will fail to unmount it cleanly. Inspired by what
m7 does.