older openssl versions do not support -nosalt (but also do not
complain about it). So we pre-generate key/iv for all the existing
textual keys (equalling the file size) on a new openssl and
use those.

good it doesn't, I was already wondering about this odd concept

with high concurrency, possibly related to context switching,
dd would read a short block.

Fix this using the fullblock flag

This will leave a bit less of a mess, yet the build system is still
not entirely connect, for instance, out-of-tree builds will not work.