When a private key is passphrase-protected and Crack cannot recover the
passphrase from the built-in wordlist, FromData set a verification error
on the result but then continued past the append, dropping the finding
entirely. An encrypted key committed to a repository is still a real
exposure (offline-crackable, weak or legacy KDFs, and the passphrase is
often reused or committed nearby), so it should surface as an unverified
finding.
Append the result before continuing so the encrypted key is reported as
unverified with its verification error and encrypted:true metadata,
matching how unencrypted keys are already reported under
--no-verification.
Closes#5115
Co-authored-by: Shahzad Haider <[email protected]>
