I posted about this a while back. I think the issue is KeyClone is getting confused with the encrypted data in the config file and not saving it back out correctly.