But yeah, store the private key, but make it encrypted by a secure password only decrypted locally, and update documentation to make this clear. I think even t

But yeah, store the private key, but make it encrypted by a secure password only decrypted locally, and update documentation to make this clear. I think even this is "too secure". I forget my 'secure passwords' regularly, and I'm sure I wouldn't be the only one. It's not a huge improvement over telling a user to print out a private key and keep it somewhere safe. Given the likely threats to Backblaze, I'd encrypt user backup private keys with a threshold or other multi-key scheme. No individual Backblaze employee's key would be sufficient to decrypt a backup; you'd need the active participation (and private knowledge) of at least a few. That prevents individuals from snooping, and requires compromising several employees to decrypt backup data.