integrity: provide a hook to load keys when rootfs is ready