Applications that check for the existence of a file normally get -ENOENT when the filename does not exist.
To reduce issues with applications running on clients without keys or without fscrypt support that check for the existence of a file in an encrypted directory, we could return -ENOKEY in the case the filename is missing. That would at least catch applications that are looking for -ENOENT when trying to check if a file already exists.