Store not_valid_{before,after} when reading encrypted KDMs.