Oh sorry, I think I'd lost that bit of context. This scenario of hiding a password during inspection is probably the main place where "security through obscurit

Oh sorry, I think I'd lost that bit of context. This scenario of hiding a password during inspection is probably the main place where "security through obscurity" has validity. A big benefit of encrypting your cryptocurrency private key with a password and then hiding/obscuring that password instead of the raw private key itself is that good encryption will apply key-stretching to the password, making it harder to brute-force. If an attacker finds a random-looking value in your stuff, and believes that the value might be your bitcoin private key XORed by a short string, they it's very cheap for them to check whether each result is a valid bitcoin private key. There might even be structure in the bitcoin private key format that helps gives away the XOR key. But if they know your bitcoin private key (or something else) is encrypted by Age, and they find a random-looking value that might be your password XORed by a short string, then because Age uses scrypt on the password, then it will take longer for them to verify each attempt against the ciphertext.