fscrypt: use ENOKEY when file cannot be created w/o key