OpenAFS has a weird design in that it has binaries in the etc directory. Portage's config file management treats these just like configuration files - this caused quite a headache when I wondered why a bug I thought was fixed in a newer version kept happening.<g>
Fixed, next time openafs is emerged it should add the file 01openafs to /etc/env.d with CONFIG_PROTECT_MASK=/etc/afs" as its contents. If you like you can add this file without re-emerging the package.
One problem with the fix - there are some configuration files in /etc/afs as well. The directories /etc/afs/C, /etc/afs/afsws, and /etc/afsws/modload should be masked. /etc/afs should not.
Updated, thanks for the submission.