Actually, there is per-chunk HMAC support in the protocol and present revisions add HMAC for each chunk into Meta: https://github.com/Librevault/librevault-comm

Actually, there is per-chunk HMAC support in the protocol and present revisions add HMAC for each chunk into Meta: https://github.com/Librevault/librevault-common/blob/master/src/Meta_s.proto#L68 https://github.com/Librevault/librevault-common/blob/master/... This HMAC is computed over plaintext chunks and used to determine, if we already have this chunk in database (because of random IV we get different hash of ciphertext every time), not for verification. And what is wrong about verifying integrity and authenticity by hash-then-sign?