Wow, I just looked at the issues in the repo, and the position of the developers is indeed that there will be no signing - so you can verify the recipient, but

Wow, I just looked at the issues in the repo, and the position of the developers is indeed that there will be no signing - so you can verify the recipient, but never the sender. So if I have your public key, I can just replace all your backups for example - and age cannot help you detect that. (for the particular use-case of encrypt-to-self, one could use the authenticated symmetric encryption, rather than public key - and assume the pass phrase is kept secret). But then your backup client can both "read and write" your backups - rather than just encrypt (to your public key) and sign (with backup instance private key). So you get.. 30% of the benefits of public key encryption, for 90% of the complexity?