[hadoukenio]

That's a great explanation. Thanks for that. Now I'm curious about why it's so locked down at Matasano... what are the main threats to need full-disk encryption and then multiple encrypted containers per project?

I should have explained my reasoning for originally choosing ecryptfs. I find it really convenient doing a backup of ecryptfs' cipher-text. Since it's simple files, an rsync will do. If I wanted to backup virtual encrypted disks, I would first have to mount source and destination to do an rsync, or painstakingly do an entire dd without the mount... maybe I'm just doing it wrong?

[wglb]

First protection is against laptop being stolen and the hazmat is exposed.

Separate vaults are useful if you have multiple clients, say, and you are doing pen tests. While you are working on one, the others are not unlocked.