Feature 0.5
Encrypted key backups & recovery keys
Survive a closed tab without giving us your keys.
Live on /created/; hub import of .hcbackup.json on homepage
About this feature
Why it matters
Browser-held keys are powerful and fragile. Without backup, losing the create tab means losing revoke and live-control ability - the sticker still scans, but the owner cannot mutate it.
Design decisions
Encrypted backup export uses a user-chosen passphrase (client-side crypto; logic mirrored in Worker tests). Optional recovery key pair can sign revoke and live-control responses separately from the owner key - useful for “break glass” without daily use.
Safety · privacy · security
Operator never receives plaintext private keys. Backup blobs are useless without the passphrase. Recovery key display is explicit - user must save it; we do not email or cloud-store secrets.
Limits
No “forgot password” recovery from humanity.llc. Weak passphrases or lost backups are owner responsibility. Recovery key compromise equals signing power for that card.
Future directions
Passkey-wrapped backups, hardware wallet integration, optional steward-assisted recovery ceremonies - always opt-in, never default key escrow.