In answer to comment#15 I can confirm that the problem that led to my original report ("ecryptfs-mount-private" failing when run remotely) is solved by the workaround of running "keyctl link @us @s" first. And running "keyctl link @us @s" before "ecryptfs-setup-private" also allows that command to work as expected.