I would approach the issue with storage-ng (so roughly SLE15 time). The new libstorage-ng already provides fine control over whether an encryption layer will be inserted in or removed from /etc/crypttab.