We're using PKCS#8 syntax, drop the OpenLDAP syntax OID. Rename attribute accordingly. Tweak validator to accept encrypted keys.