Don't write encryption keyfiles to an unencrypted root partition

[dylanmtaylor]

Fixes #1856

When encrypting partitions like /home but not /, the keyfiles were written to the unencrypted root filesystem in plaintext, defeating the purpose of the encryption.

Now keyfiles are only generated when root is also encrypted. Otherwise, systemd-cryptsetup will prompt for the passphrase at boot instead.

[dylanmtaylor]

This might be as straightforward as it seems, needs tested still, so in draft. I suspect we will run into an issue because we still need a crypttab entry but with none as the keyfile so systemd prompts for the passphrase.

Edit: This is the case, I updated the PR to address ^^

[dylanmtaylor]

Testing:

Manual partitioning:

Encryption enabled on just /home

/etc/crypttab contains home partition with "none" set

/etc/cryptsetup-keys.d does NOT have the key for home:

home password prompt on boot;

[dylanmtaylor]

This is tested and confirmed to work correctly. ^^

After entering the /home password, I was able to log into the system normally.