keyfile-erase only erases a key file explicitly configured in the third field of crypttab. Key files automatically discovered in /etc/cryptsetup-keys.d/ and /run/cryptsetup-keys.d/ are considered shared resources not owned by an individual volume, and are never erased. Make this explicit in the documentation and add a code comment clarifying the intent. Fixes: https://github.com/systemd/systemd/issues/41127 Co-developed-by: Claude Opus 4.8 <noreply@anthropic.com>