Add RequiresMountsFor=/opt to central-key-manager.service.