Are you running any custom kip sysmodules, qlaunch overrides or launching hbmenu with something other than Album or anything else custom? If so can you try without?
I researched this pretty extensively in the making of Lockpick and unfortunately it can't be done due to security features of the Switch. The only workarounds are via payload and Hekate is the cleanest one short of dumping all the keys by payload, which would be ideal, but I haven't looked into it yet. It would also be much slower and there's basically no way around that.