Crate coven_keys 

Keys: device and master key custody, the sealed-secret files that hold them, and the cipher every encrypted Coven object is sealed with.

This crate owns the key-bearing primitives — signing keys, sealed-box keys, the AEAD cipher, the passphrase KDF, and the platform keyring — so the layers above it hold custody objects rather than raw key material.

envelope and keyring_backend are private: the passphrase vault and the keyring-store installer are how custody and the key service do their work, not something a caller composes.

Modules

custody

Master-key custody: where the store’s master keyring is unlocked from, where a newly established or rotated one is written, and how it is removed. KeyCustody is the policy a host selects on the builder; KeyCustody::resolve turns it into the MasterKeyCustody trait object coven drives the rest of the sync engine through.

encryption

identity_custody

A store’s device-identity custody: where its signing keypair is unlocked from, where a newly established one is written, and how it is removed. IdentityCustody is the policy a host selects on the builder, next to crate::custody::KeyCustody; IdentityCustody::resolve turns it into the DeviceIdentityCustody trait object the identity-establishing call sites (create, join, restore) drive.

keys