> Seems like a good approach, if you use asymmetric encryption. Keep the private key in a safe place, and the public on the machine; then you can store new code

> Seems like a good approach, if you use asymmetric encryption. Keep the private key in a safe place, and the public on the machine; then you can store new codes (by encrypting them with the public key) without having to access the safe place. Interesting idea. I had just been picturing a second keepass db with a different passphrase (or use a usb key with a keyfile kept offsite) but I like yours too. (I'm also trying to brainstorm solutions scalable to non-experts so "&Ok fire up the CLI, we're doing GPG*" might work for me, but not everyone in my org :) )