This replicates what 475c473d32 did for cryptenroll for repart, which has very similar code for this.
475c473d32