[kmeisthax]

AFAIK there's (private?) API surface to request a container that isn't encrypted to your PIN specifically for the lock screen to work.