systemctl start keylime_registrar hangs (waiting for password or timeout?)

If you check with ps when start hangs you find this:
```

\_ systemctl start keylime_registrar
\_ /bin/systemd-tty-ask-password-agent --watch

```

Start by reproducing the hang with `systemctl start keylime_registrar` and inspect the resulting `systemd-tty-ask-password-agent --watch` process. Trace the registrar service definition and its startup dependencies to determine why a password prompt is requested; done means the service starts without hanging or waiting for an unexpected password.

Written by the indexing model from the issue text.