You need to somehow order the enctypes though so that enctypes that
end up in the restricted application set come first (and in their
order) when using conf_ktypes.

If you do that, this sounds reasonable.