[Macha]

What does this gain over just encrypting the drive/backups? Anything running on the system has the same access.

If the drive is not encrypted, surely for Windows at least it's possible to reverse engineer the encryption secret. Maybe on Mac you could do something with T2, but now your config is not portable, and still doesn't solve the malware on the system case or the "your sibling/visitor/housemate whoever has physical access".

[Avery3R]

In a multi-user system using DPAPI [1] on windows protects secrets from other users, even if the disk is not encrypted. Secrets are encrypted with the user's password.

[1]: https://web.archive.org/web/20200830203837/https://docs.micr...