I finally figured this one out!
The kernel was compiled without sha256 support, was able to compile that as a module against (roughly) compatible kernel sources I found here:
http://git.freescale.com/git/
After that module is loaded, encryption completes. You can then add that module to the init.freescale.rc to make it load on boot.
The only snag was that the touchscreen stopped responding after boot completed, just needed to restart 'onyx_tpd' after the crypto device is mounted, there are events for that in the init rc as well.
maybe nobody cares but me, but I thought it might help someone someday!