common/encrypt: add helper function for filtering no-key names