I see that /usr/lib/pam.d/login has pam_keyinit.so before common-session, while /etc/pam.d/sddm has it the other way around. Maybe that makes a difference? Does it work with xdm?