for #15711, this attempts to decrypt the disk if it was previously encrypted and Fleet doesn't have the key.