[woodruffw]

I'm sympathetic to the idea that a company is going to be better at doing backups and maintenance than I am, but for the first point: it sounds like they're using the local machine's SSH key to wrap a symmetric key[1]. Unless you're sharing the same SSH key across all of your machines, this tool probably isn't very useful when switching between computers.

Edit: It looks like they generate their own SSH key instead of using an already present one[2]. So you'd presumably need to copy that to each machine that you'd want to use so that it can unwrap the real (cloud-stored) decryption key.

[1]: https://github.com/charmbracelet/charm#how-it-works

[2]: https://github.com/charmbracelet/charm/blob/master/keygen/ke...

[tobypadilla]

Hi! I'm one of the Charm co-founders.

We actually issue a new Charm specific SSH key for you. We then allow you to link machines together with our `charm` account utility. The symmetric keys used to encrypt data are encrypted for each public key linked to your account so you can access your data from multiple machines.

[woodruffw]

Thanks for the explanation! Glad to hear you've thought out and handled the linking process.

Just out of curiosity: have you seen or considered age[1] for the symmetric pair? I've used it on a few projects where cryptographic flexibility wasn't necessary.

[1]: https://github.com/FiloSottile/age

[tobypadilla]

We actually ended up making our own encryption library that's based on age, it's called sasquatch (built by our team member muesli):

https://github.com/muesli/sasquatch