someone elsewhere mentioned they use a key (encryption key) per user and just change the key, but A) i don't buy that, how do you prove you deleted a key? and i

someone elsewhere mentioned they use a key (encryption key) per user and just change the key, but A) i don't buy that, how do you prove you deleted a key? and if the user maintains the key and can revoke both their and the service's access to their data, lots of users will do this accidentally. Look at, say, matrix from a few years back, it'd constantly hose your keys and you'd have to attempt to restore from a backup key, but not that key, that's the first key - and apparently you accidentally clicked "backup key" again at some point and now all your stuff is that new key, even though you didn't specify you wanted a new key, you just clicked "back up key" to see what it did. Also i "permanently" deleted a facebook account 2 years ago, and through a quirk on a cellphone facebook immediately brought the account back like it had never been deleted. I issued another "permanent delete" for that account a week ago, but i bet dollars to doughnuts in 5 weeks i will still be able to "oops i forgot my password, send me an SMS" will reactivate the account again. If facebook can't or won't do it, i don't really think anyone handles this correctly. Except people like me that store everything that users upload in tmpfs, and whenever i feel like it, i bounce the box. Good luck recovering any PII from that system. Unfortunately it doesn't have access control (there is no access to the system - that is, ssh, login, shell, whatever - from outside.), so i can't claim hipaa compliance. That and it doesn't log, so after a bounce i can't even verify who did what. Most users won't stand for this kind of thing, but the users that can, depend on my random reboots if they forget a delete key (usually reloading the tab will "forget" the delete key.)