qcow2/qcow: protect against uninitialized encryption key