Okay, I found the problem - the metadata didn’t include the RenderLayer name as part of the pass name.
However, there’s another issue: Nuke apparently doesn’t like the Layer.Pass.Channel naming scheme and changes it to Layer_Pass.Channel, so it only loads the Cycles Cryptomatte if I output the metadata with that naming scheme as well. However, other software might not do that and then in turn be unable to find the “RenderLayer_CryptoObject” pass. And if I output both, Nuke stops working again…
Not really sure how to fix this, I’ll have to think about it.