Make sure that the permissions of /etc/salt/grains only allow access for the root user.
Use debian/contrib-jessie64 base box, install python-cryptography before saltstack bootstrap.