it's the same nvram field that the file server uses to
hold the name of the config block device, but the
cpu/auth server (now) uses to hold the key for secstore.
the 4e auth/wrkey prompts with `secstore key'.
i don't think the old cpu/auth server did anything with it.