Finalize interception for systemd cryptenroll

the unseal uses two sessions (policy and encryption) for no readily
apparent reason, so cope with this correctly.

Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>