This fixes us sometimes using subkeys whose key flags allow encryption but don't have a valid algorithm for encryption, or that are expired, etc.