[cperciva]

making backups secure from attackers that have root access is a pretty hard problem

Tarsnap handles this easily with restricted keyfiles. :-)