You will need to adjust how you generate your initrd to include
early-ssh and to start it at the correct time.

Example for LUKS + LVM as described in README_CRYPT.TXT:

mkinitrd -c -k "$kernel" -f ext4 -r /dev/disk/by-uuid/<some uuid> \
  -m ext4:<more modules> -u -L -o /boot/initrd-"$kernel".gz \
  -C /dev/disk/by-uuid/<some other uuid>
  -s /tmp/initrd-tree-"$kernel"

# clear the luksdev so init does not try to unlock it itself
true > /tmp/initrd-tree-"$kernel"/luksdev
DESTDIR=/tmp/initrd-tree-"$kernel" /usr/share/mkinitrd/hooks/early_ssh
sed -i '/^[[:space:]]*if \[ -x \/sbin\/cryptsetup \]/i \
  \/early_ssh' /tmp/initrd-tree-"$kernel"/init

mkinitrd -k "$kernel" -f ext4 -r /dev/disk/by-uuid/<some uuid> -u -L \
  -o /boot/initrd-"$kernel".gz -s /tmp/initrd-tree-"$kernel"
