[rzzzt]

The Data Protection API makes this quite easy from a programming standpoint (it also makes relocating keys to another machine hard, but in this case this should count as another upside): https://en.wikipedia.org/wiki/Data_Protection_API