This would indeed work! I'm still studying their code for handling the recovery key, but as of yet I haven't found any asymmetric encryption of PII. It does lo

This would indeed work! I'm still studying their code for handling the recovery key, but as of yet I haven't found any asymmetric encryption of PII. It does look like they are using the recovery key as a second password, and running it through scrypt to verify it, but I haven't traced past that point yet, and Ruby is not my first, second, or 3rd language. From what I can tell, they do the same key derivation process as with the primary password, but then also encrypt the secondary 'cek' with another key -- perhaps just HSM(R) -- so they can get back 'cek' without needing the token. But I'm not sure I'm reading it right because there are variables called things like 'encryption_key', 'encrypted_code', 'encryption_code', 'encrypted_key', 'encrypted_password', 'personal_code', 'raw_personal_code', 'code', 'hashed_code', ahhhh..... If there's one good thing to say about all this, the fact it's open source and I can even look at it all, and open issues on GitHub against the US Government's code for authenticating citizens... well just that is pretty awesome.