what's the use-case for disabling encrypted swap later? i'd argue we should avoid kauth for this and simply disable it always as i've been unable to think of any use case that is the only solution. .mrg.