I don't consider Tarsnap's actual storage to be part of the cryptosystem – it's no different than the data simply being "in transit" indefinitely – so "compromi

I don't consider Tarsnap's actual storage to be part of the cryptosystem – it's no different than the data simply being "in transit" indefinitely – so "compromising" a Tarsnap server has no real meaning from a cryptographic point of view. I totally agree with you about Backblaze; at least with Tarsnap, the physical machines and environments that are actually part of the cryptosystem are in your own control. Oh, and the "in fairness" was that compromised clients have the same problem as compromised servers. Perhaps I could have worded it better – I don't have any problem with what you wrote at all.