curtin leaves behind /usr/sbin/policy-rc.d file that prevents invoke-rc.d from starting services

DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=12.04
DISTRIB_CODENAME=precise
DISTRIB_DESCRIPTION="Ubuntu 12.04.3 LTS"

# dpkg -l | grep keystone
ii keystone 1:2013.1.3-0ubuntu1~cloud0 OpenStack identity service - Daemons
ii python-keystone 1:2013.1.3-0ubuntu1~cloud0 OpenStack identity service - Python library
ii python-keystoneclient 1:0.2.3-0ubuntu2.2~cloud0 Client library for OpenStack Identity API

When installing the package, the service fails to start due to a invoke-rc.d: policy-rc.d denied execution of start.
So far I've only hit this on precise nodes that I've provisioned with MAAS using curtin.

# apt-get install keystone
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
  keystone
0 upgraded, 1 newly installed, 0 to remove and 8 not upgraded.
Need to get 16.7 kB of archives.
After this operation, 143 kB of additional disk space will be used.
Get:1 http://ubuntu-cloud.archive.canonical.com/ubuntu/ precise-updates/grizzly/main keystone all 1:2013.1.3-0ubuntu1~cloud0 [16.7 kB]
Fetched 16.7 kB in 0s (0 B/s)
Selecting previously unselected package keystone.
(Reading database ... 42113 files and directories currently installed.)
Unpacking keystone (from .../keystone_1%3a2013.1.3-0ubuntu1~cloud0_all.deb) ...
Processing triggers for man-db ...
Processing triggers for ureadahead ...
Setting up keystone (1:2013.1.3-0ubuntu1~cloud0) ...
Generating RSA private key, 1024 bit long modulus
.........................................++++++
...........++++++
e is 65537 (0x10001)
Generating RSA private key, 1024 bit long modulus
...................................++++++
..............++++++
e is 65537 (0x10001)
Using configuration from /etc/keystone/ssl/certs/openssl.conf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'US'
stateOrProvinceName :PRINTABLE:'Unset'
localityName :PRINTABLE:'Unset'
organizationName :PRINTABLE:'Unset'
commonName :PRINTABLE:'www.example.com'
Certificate is to be certified until Oct 11 18:27:33 2014 GMT (365 days)

Write out database with 1 new entries
Data Base Updated
invoke-rc.d: policy-rc.d denied execution of start.