Comment 116 for bug 439138

Making the gdm and kdm jobs depend on cryptsetup is not a solution because cryptsetup is optional and depending on an optional job doesn't DTRT.

This is the same problem for "executing cryptsetup before anything else" - you can't ensure it's executed serially if you can't depend on it being executed at all.