Problem
Split out from #11 (now closed). drs keygen is safe by default at the interface level — it never prints private key material, and the keystore file is created wx with mode 0o600. But the file content is plaintext hex: file permissions are the only barrier. Backup tools, misconfigured sync clients, and multi-user hosts can all leak it.
What to do
Encrypt the private key at rest:
- passphrase-based encryption of the keystore file (scrypt/argon2id KDF + AEAD)
- prompt for the passphrase at generation and at signing-time use
- keep the raw plaintext path behind an explicit, loud escape hatch only
- document the threat model: what encryption at rest does and does not protect against
Acceptance criteria
- keystore written by default is not plaintext
- wrong passphrase fails cleanly with a typed error, no partial reads
- tests cover encrypt/decrypt round-trip and wrong-passphrase failure
- docs show the passphrase flow first
Out of scope
- KMS / HSM support
- organisation-wide key rotation
- wallet integrations
Problem
Split out from #11 (now closed).
drs keygenis safe by default at the interface level — it never prints private key material, and the keystore file is createdwxwith mode0o600. But the file content is plaintext hex: file permissions are the only barrier. Backup tools, misconfigured sync clients, and multi-user hosts can all leak it.What to do
Encrypt the private key at rest:
Acceptance criteria
Out of scope