Automatic for debug builds

Test disable entirely for pre-export
Fix export path
2026-04-10 11:17:24 +02:00 · 2022-11-20 16:40:04 -08:00 · 2022-11-20 16:30:56 -08:00 · 2022-11-20 16:03:58 -08:00 · 2022-11-20 15:42:02 -08:00 · 2022-11-20 15:37:58 -08:00
38 changed files with 460 additions and 1047 deletions
--- a/.github/readme/app-dark.png
+++ b/.github/readme/app-dark.png
--- a/.github/readme/app-light.png
+++ b/.github/readme/app-light.png
--- a/.github/readme/app.png
+++ b/.github/readme/app.png
--- a/.github/scripts/signing.sh
+++ b/.github/scripts/signing.sh
@@ -1,22 +1,5 @@
 #!/bin/bash

-# Import certificate and private key
-echo $SIGNING_DATA | base64 -d -o Signing.p12
-security create-keychain -p ci ci.keychain
-security default-keychain -s ci.keychain
-security list-keychains -s ci.keychain
-security import ./Signing.p12 -k ci.keychain -P $SIGNING_PASSWORD -A
-security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k ci ci.keychain
-
-# Import Profiles
-mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
-echo $HOST_PROFILE_DATA | base64 -d -o Host.provisionprofile
-HOST_UUID=`grep UUID -A1 -a Host.provisionprofile | grep -io "[-A-F0-9]\{36\}"`
-cp Host.provisionprofile ~/Library/MobileDevice/Provisioning\ Profiles/$HOST_UUID.provisionprofile
-echo $AGENT_PROFILE_DATA | base64 -d -o Agent.provisionprofile
-AGENT_UUID=`grep UUID -A1 -a Agent.provisionprofile | grep -io "[-A-F0-9]\{36\}"`
-cp Agent.provisionprofile ~/Library/MobileDevice/Provisioning\ Profiles/$AGENT_UUID.provisionprofile
-
 # Create directories for ASC key
 mkdir ~/.private_keys
-echo -n "$APPLE_API_KEY_DATA" > ~/.private_keys/AuthKey_$APPLE_API_KEY_ID.p8
+echo -n "$APPLE_API_KEY_DATA" > ~/.private_keys/AuthKey.p8
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -5,8 +5,7 @@ on:
    - cron: "0 8 * * *"
 jobs:
  build:
-#     runs-on: macOS-latest
-    runs-on: macos-13
+    runs-on: macOS-latest
    timeout-minutes: 10
    steps:
    - uses: actions/checkout@v2
@@ -20,7 +19,7 @@ jobs:
        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
      run: ./.github/scripts/signing.sh
    - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_14.3.app
+      run: sudo xcrun xcode-select -s /Applications/Xcode_14.1.app
    - name: Update Build Number
      env:
        RUN_ID: ${{ github.run_id }}
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,34 +5,33 @@ on:
    tags:
      - '*'
 jobs:
-  test:
-#     runs-on: macOS-latest
-    runs-on: macos-13
-    timeout-minutes: 10
-    steps:
-    - uses: actions/checkout@v1
-    - name: Setup Signing
-      env: 
-        SIGNING_DATA: ${{ secrets.SIGNING_DATA }}
-        SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
-        HOST_PROFILE_DATA: ${{ secrets.HOST_PROFILE_DATA }}
-        AGENT_PROFILE_DATA: ${{ secrets.AGENT_PROFILE_DATA }}
-        APPLE_API_KEY_DATA: ${{ secrets.APPLE_API_KEY_DATA }}
-        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
-      run: ./.github/scripts/signing.sh
-    - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_14.3.app
-    - name: Test
-      run: |
-            pushd Sources/Packages
-            swift test
-            popd
+  # test:
+  #   runs-on: macOS-latest
+  #   timeout-minutes: 10
+  #   steps:
+  #   - uses: actions/checkout@v3
+  #   - name: Setup Signing
+  #     env: 
+  #       SIGNING_DATA: ${{ secrets.SIGNING_DATA }}
+  #       SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
+  #       HOST_PROFILE_DATA: ${{ secrets.HOST_PROFILE_DATA }}
+  #       AGENT_PROFILE_DATA: ${{ secrets.AGENT_PROFILE_DATA }}
+  #       APPLE_API_KEY_DATA: ${{ secrets.APPLE_API_KEY_DATA }}
+  #       APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+  #     run: ./.github/scripts/signing.sh
+    # - name: Set Environment
+    #   run: sudo xcrun xcode-select -s /Applications/Xcode_14.1.app
+    # - name: Test
+    #   run: |
+    #         pushd Sources/Packages
+    #         swift test
+    #         popd
+
  build:
-#     runs-on: macOS-latest
-    runs-on: macos-13
+    runs-on: macOS-latest
    timeout-minutes: 10
    steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
    - name: Setup Signing
      env: 
        SIGNING_DATA: ${{ secrets.SIGNING_DATA }}
@@ -43,7 +42,7 @@ jobs:
        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
      run: ./.github/scripts/signing.sh
    - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_14.3.app
+      run: sudo xcrun xcode-select -s /Applications/Xcode_14.1.app
    - name: Update Build Number
      env:
        TAG_NAME: ${{ github.ref }}
@@ -54,16 +53,24 @@ jobs:
            sed -i '' -e "s/GITHUB_BUILD_NUMBER/1.$RUN_ID/g" Sources/Config/Config.xcconfig
            sed -i '' -e "s/GITHUB_BUILD_URL/https:\/\/github.com\/maxgoedjen\/secretive\/actions\/runs\/$RUN_ID/g" Sources/Secretive/Credits.rtf
    - name: Build
-      run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme Secretive -configuration Release -archivePath Archive.xcarchive archive
+      env: 
+        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+        APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+      run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme Secretive -configuration Release -archivePath Archive.xcarchive -destination "generic/platform=macOS" archive
+    - name: Export Products
+      env: 
+        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+        APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+      run: xcrun xcodebuild -exportArchive -archivePath Archive.xcarchive -exportPath Export -exportOptionsPlist Sources/Config/ExportOptions.plist -allowProvisioningUpdates -authenticationKeyIssuerID $APPLE_API_ISSUER -authenticationKeyID $APPLE_API_KEY_ID -authenticationKeyPath ~/.private_keys/AuthKey.p8
    - name: Create ZIPs
      run: |
-            ditto -c -k --sequesterRsrc --keepParent Archive.xcarchive/Products/Applications/Secretive.app ./Secretive.zip
+            ditto -c -k --sequesterRsrc --keepParent Export/Secretive.app ./Secretive.zip
            ditto -c -k --sequesterRsrc --keepParent Archive.xcarchive ./Archive.zip
    - name: Notarize
      env: 
        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
        APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
-      run: xcrun notarytool submit --key ~/.private_keys/AuthKey_$APPLE_API_KEY_ID.p8 --key-id $APPLE_API_KEY_ID --issuer $APPLE_API_ISSUER Secretive.zip
+      run: xcrun notarytool submit --key $(pwd)/.private_keys/AuthKey_$APPLE_API_KEY_ID.p8 --key-id $APPLE_API_KEY_ID --issuer $APPLE_API_ISSUER Secretive.zip
    - name: Document SHAs
      run: |
            echo "sha-512:"
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -3,13 +3,12 @@ name: Test
 on: [push, pull_request]
 jobs:
  test:
-#     runs-on: macOS-latest
-    runs-on: macos-13
+    runs-on: macOS-latest
    timeout-minutes: 10
    steps:
    - uses: actions/checkout@v2
    - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_14.3.app
+      run: sudo xcrun xcode-select -s /Applications/Xcode_14.1.app
    - name: Test
      run: |
            pushd Sources/Packages
--- a/README.md
+++ b/README.md
@@ -3,10 +3,7 @@

 Secretive is an app for storing and managing SSH keys in the Secure Enclave. It is inspired by the [sekey project](https://github.com/sekey/sekey), but rewritten in Swift with no external dependencies and with a handy native management app.

-<picture>
-  <source media="(prefers-color-scheme: dark)" srcset="/.github/readme/app-dark.png">
-  <img src="/.github/readme/app-light.png" alt="Screenshot of Secretive" width="600">
-</picture>
+<img src="/.github/readme/app.png" alt="Screenshot of Secretive" width="600">


 ## Why?
@@ -17,7 +14,7 @@ The most common setup for SSH keys is just keeping them on disk, guarded by prop

 ### Access Control

-If your Mac has a Secure Enclave, it also has support for strong access controls like Touch ID, or authentication with Apple Watch. You can configure your keys so that they require Touch ID (or Watch) authentication before they're accessed.
+If your Mac has a Secure Enclave, it also has support for strong access controls like Touch ID, or authentication with Apple Watch. You can configure your key so that they require Touch ID (or Watch) authentication before they're accessed.

 <img src="/.github/readme/touchid.png" alt="Screenshot of Secretive authenticating with Touch ID" width="400">

--- a/Sources/Config/ExportOptions.plist
+++ b/Sources/Config/ExportOptions.plist
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>method</key>
+	<string>developer-id</string>
+	<key>teamID</key>
+	<string>Z72PRUAWF6</string>
+</dict>
+</plist>
--- a/Sources/Packages/Sources/Brief/UpdaterProtocol.swift
+++ b/Sources/Packages/Sources/Brief/UpdaterProtocol.swift
@@ -1,5 +1,4 @@
 import Foundation
-import Combine

 /// A protocol for retreiving the latest available version of an app.
 public protocol UpdaterProtocol: ObservableObject {
--- a/Sources/Packages/Sources/SecretAgentKit/Agent.swift
+++ b/Sources/Packages/Sources/SecretAgentKit/Agent.swift
@@ -4,6 +4,25 @@ import OSLog
 import SecretKit
 import AppKit

+enum OpenSSHCertificateError: Error {
+    case unsupportedType
+    case parsingFailed
+    case doesNotExist
+}
+
+extension OpenSSHCertificateError: CustomStringConvertible {
+    public var description: String {
+        switch self {
+        case .unsupportedType:
+            return "The key type was unsupported"
+        case .parsingFailed:
+            return "Failed to properly parse the SSH certificate"
+        case .doesNotExist:
+            return "Certificate does not exist"
+        }
+    }
+}
+
 /// The `Agent` is an implementation of an SSH agent. It manages coordination and access between a socket, traces requests, notifies witnesses and passes requests to stores.
 public class Agent {

@@ -11,18 +30,16 @@ public class Agent {
    private let witness: SigningWitness?
    private let writer = OpenSSHKeyWriter()
    private let requestTracer = SigningRequestTracer()
-    private let certificateHandler = OpenSSHCertificateHandler()
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent.agent", category: "")
+    private let certsPath = (NSHomeDirectory() as NSString).appendingPathComponent("PublicKeys") as String

    /// Initializes an agent with a store list and a witness.
    /// - Parameters:
    ///   - storeList: The `SecretStoreList` to make available.
    ///   - witness: A witness to notify of requests.
    public init(storeList: SecretStoreList, witness: SigningWitness? = nil) {
-        logger.debug("Agent is running")
+        Logger().debug("Agent is running")
        self.storeList = storeList
        self.witness = witness
-        certificateHandler.reloadCertificates(for: storeList.allSecrets)
    }
    
 }
@@ -36,16 +53,16 @@ extension Agent {
    /// - Return value: 
    ///   - Boolean if data could be read
    @discardableResult public func handle(reader: FileHandleReader, writer: FileHandleWriter) -> Bool {
-        logger.debug("Agent handling new data")
+        Logger().debug("Agent handling new data")
        let data = Data(reader.availableData)
        guard data.count > 4 else { return false}
        let requestTypeInt = data[4]
        guard let requestType = SSHAgent.RequestType(rawValue: requestTypeInt) else {
            writer.write(OpenSSHKeyWriter().lengthAndData(of: SSHAgent.ResponseType.agentFailure.data))
-            logger.debug("Agent returned \(SSHAgent.ResponseType.agentFailure.debugDescription)")
+            Logger().debug("Agent returned \(SSHAgent.ResponseType.agentFailure.debugDescription)")
            return true
        }
-        logger.debug("Agent handling request of type \(requestType.debugDescription)")
+        Logger().debug("Agent handling request of type \(requestType.debugDescription)")
        let subData = Data(data[5...])
        let response = handle(requestType: requestType, data: subData, reader: reader)
        writer.write(response)
@@ -53,25 +70,23 @@ extension Agent {
    }

    func handle(requestType: SSHAgent.RequestType, data: Data, reader: FileHandleReader) -> Data {
-        // Depending on the launch context (such as after macOS update), the agent may need to reload secrets before acting
-        reloadSecretsIfNeccessary()
        var response = Data()
        do {
            switch requestType {
            case .requestIdentities:
                response.append(SSHAgent.ResponseType.agentIdentitiesAnswer.data)
                response.append(identities())
-                logger.debug("Agent returned \(SSHAgent.ResponseType.agentIdentitiesAnswer.debugDescription)")
+                Logger().debug("Agent returned \(SSHAgent.ResponseType.agentIdentitiesAnswer.debugDescription)")
            case .signRequest:
                let provenance = requestTracer.provenance(from: reader)
                response.append(SSHAgent.ResponseType.agentSignResponse.data)
                response.append(try sign(data: data, provenance: provenance))
-                logger.debug("Agent returned \(SSHAgent.ResponseType.agentSignResponse.debugDescription)")
+                Logger().debug("Agent returned \(SSHAgent.ResponseType.agentSignResponse.debugDescription)")
            }
        } catch {
            response.removeAll()
            response.append(SSHAgent.ResponseType.agentFailure.data)
-            logger.debug("Agent returned \(SSHAgent.ResponseType.agentFailure.debugDescription)")
+            Logger().debug("Agent returned \(SSHAgent.ResponseType.agentFailure.debugDescription)")
        }
        let full = OpenSSHKeyWriter().lengthAndData(of: response)
        return full
@@ -84,26 +99,28 @@ extension Agent {
    /// Lists the identities available for signing operations
    /// - Returns: An OpenSSH formatted Data payload listing the identities available for signing operations.
    func identities() -> Data {
-        let secrets = storeList.allSecrets
-        certificateHandler.reloadCertificates(for: secrets)
-        var count = secrets.count
+        let secrets = storeList.stores.flatMap(\.secrets)
+        var count = UInt32(secrets.count).bigEndian
+        let countData = Data(bytes: &count, count: UInt32.bitWidth/8)
        var keyData = Data()

        for secret in secrets {
-            let keyBlob = writer.data(secret: secret)
-            let curveData = writer.curveType(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!
+            let keyBlob: Data
+            let curveData: Data
+            
+            if let (certBlob, certName) = try? checkForCert(secret: secret) {
+                keyBlob = certBlob
+                curveData = certName
+            } else {
+                keyBlob = writer.data(secret: secret)
+                curveData = writer.curveType(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!
+            }
+            
            keyData.append(writer.lengthAndData(of: keyBlob))
            keyData.append(writer.lengthAndData(of: curveData))
            
-            if let (certificateData, name) = try? certificateHandler.keyBlobAndName(for: secret) {
-                keyData.append(writer.lengthAndData(of: certificateData))
-                keyData.append(writer.lengthAndData(of: name))
-                count += 1
        }
-        }
-        logger.log("Agent enumerated \(count) identities")
-        var countBigEndian = UInt32(count).bigEndian
-        let countData = Data(bytes: &countBigEndian, count: UInt32.bitWidth/8)
+        Logger().debug("Agent enumerated \(secrets.count) identities")
        return countData + keyData
    }

@@ -114,17 +131,15 @@ extension Agent {
    /// - Returns: An OpenSSH formatted Data payload containing the signed data response.
    func sign(data: Data, provenance: SigningRequestProvenance) throws -> Data {
        let reader = OpenSSHReader(data: data)
-        let payloadHash = reader.readNextChunk()
-        let hash: Data
+        var hash = reader.readNextChunk()
+        
        // Check if hash is actually an openssh certificate and reconstruct the public key if it is
-        if let certificatePublicKey = certificateHandler.publicKeyHash(from: payloadHash) {
-            hash = certificatePublicKey
-        } else {
-            hash = payloadHash
+        if let certPublicKey = try? getPublicKeyFromCert(certBlob: hash) {
+            hash = certPublicKey
        }
        
        guard let (store, secret) = secret(matching: hash) else {
-            logger.debug("Agent did not have a key matching \(hash as NSData)")
+            Logger().debug("Agent did not have a key matching \(hash as NSData)")
            throw AgentError.noMatchingKey
        }

@@ -178,25 +193,83 @@ extension Agent {
            try witness.witness(accessTo: secret, from: store, by: provenance)
        }

-        logger.debug("Agent signed request")
+        Logger().debug("Agent signed request")

        return signedData
    }
    
+    /// Reconstructs a public key from a ``Data`` object that contains an OpenSSH certificate. Currently only ecdsa certificates are supported
+    /// - Parameter certBlock: The openssh certificate to extract the public key from
+    /// - Returns: A ``Data`` object containing the public key in OpenSSH wire format
+    func getPublicKeyFromCert(certBlob: Data) throws -> Data {
+        let reader = OpenSSHReader(data: certBlob)
+        let certType = String(decoding: reader.readNextChunk(), as: UTF8.self)
+                
+        switch certType {
+        case "ecdsa-sha2-nistp256-cert-v01@openssh.com",
+            "ecdsa-sha2-nistp384-cert-v01@openssh.com",
+            "ecdsa-sha2-nistp521-cert-v01@openssh.com":
+            
+            _ = reader.readNextChunk() // nonce
+            let curveIdentifier = reader.readNextChunk()
+            let publicKey = reader.readNextChunk()
+            
+            if let curveType = certType.replacingOccurrences(of: "-cert-v01@openssh.com", with: "").data(using: .utf8) {
+                return writer.lengthAndData(of: curveType) +
+                       writer.lengthAndData(of: curveIdentifier) +
+                       writer.lengthAndData(of: publicKey)
+            } else {
+                throw OpenSSHCertificateError.parsingFailed
+            }
+        default:
+            throw OpenSSHCertificateError.unsupportedType
+        }
+    }
+    
+    
+    /// Attempts to find an OpenSSH Certificate  that corresponds to a ``Secret``
+    /// - Parameter secret: The secret to search for a certificate with
+    /// - Returns: Two ``Data`` objects containing the certificate and certificate name respectively
+    func checkForCert(secret: AnySecret) throws -> (Data, Data) {
+        let minimalHex = writer.openSSHMD5Fingerprint(secret: secret).replacingOccurrences(of: ":", with: "")
+        let certificatePath = certsPath.appending("/").appending("\(minimalHex)-cert.pub")
+        
+        if FileManager.default.fileExists(atPath: certificatePath) {
+            Logger().debug("Found certificate for \(secret.name)")
+            do {
+                let certContent = try String(contentsOfFile:certificatePath, encoding: .utf8)
+                let certElements = certContent.trimmingCharacters(in: .whitespacesAndNewlines).components(separatedBy: " ")
+                
+                if certElements.count >= 2 {
+                    if let certDecoded = Data(base64Encoded: certElements[1] as String) {
+                        if certElements.count >= 3 {
+                            if let certName = certElements[2].data(using: .utf8) {
+                                return (certDecoded, certName)
+                            } else if let certName = secret.name.data(using: .utf8) {
+                                Logger().info("Certificate for \(secret.name) does not have a name tag, using secret name instead")
+                                return (certDecoded, certName)
+                            } else {
+                                throw OpenSSHCertificateError.parsingFailed
+                            }
+                        }
+                    } else {
+                        Logger().warning("Certificate found for \(secret.name) but failed to decode base64 key")
+                        throw OpenSSHCertificateError.parsingFailed
+                    }
+                }
+            } catch {
+                Logger().warning("Certificate found for \(secret.name) but failed to load")
+                throw OpenSSHCertificateError.parsingFailed
+            }
+        }
+        
+        throw OpenSSHCertificateError.doesNotExist
+    }
+
 }

 extension Agent {

-    /// Gives any store with no loaded secrets a chance to reload.
-    func reloadSecretsIfNeccessary() {
-        for store in storeList.stores {
-            if store.secrets.isEmpty {
-                logger.debug("Store \(store.name, privacy: .public) has no loaded secrets. Reloading.")
-                store.reloadSecrets()
-            }
-        }
-    }
-
    /// Finds a ``Secret`` matching a specified hash whos signature was requested.
    /// - Parameter hash: The hash to match against.
    /// - Returns: A ``Secret`` and the ``SecretStore`` containing it, if a match is found.
@@ -222,7 +295,6 @@ extension Agent {
        case unhandledType
        case noMatchingKey
        case unsupportedKeyType
-        case notOpenSSHCertificate
    }

 }
--- a/Sources/Packages/Sources/SecretAgentKit/SSHAgentProtocol.swift
+++ b/Sources/Packages/Sources/SecretAgentKit/SSHAgentProtocol.swift
@@ -1,11 +1,11 @@
 import Foundation

-/// A namespace for the SSH Agent Protocol, as described in https://datatracker.ietf.org/doc/html/draft-miller-ssh-agent#section-5.1
+/// A namespace for the SSH Agent Protocol, as described in https://tools.ietf.org/id/draft-miller-ssh-agent-01.html
 public enum SSHAgent {}

 extension SSHAgent {

-    /// The type of the SSH Agent Request, as described in https://datatracker.ietf.org/doc/html/draft-miller-ssh-agent#section-5.1
+    /// The type of the SSH Agent Request, as described in https://tools.ietf.org/id/draft-miller-ssh-agent-01.html#rfc.section.5.1
    public enum RequestType: UInt8, CustomDebugStringConvertible {

        case requestIdentities = 11
@@ -21,11 +21,10 @@ extension SSHAgent {
        }
    }

-    /// The type of the SSH Agent Response, as described in https://datatracker.ietf.org/doc/html/draft-miller-ssh-agent#section-5.1
+    /// The type of the SSH Agent Response, as described in https://tools.ietf.org/id/draft-miller-ssh-agent-01.html#rfc.section.5.1
    public enum ResponseType: UInt8, CustomDebugStringConvertible {
        
        case agentFailure = 5
-        case agentSuccess = 6
        case agentIdentitiesAnswer = 12
        case agentSignResponse = 14

@@ -33,8 +32,6 @@ extension SSHAgent {
            switch self {
            case .agentFailure:
                return "AgentFailure"
-            case .agentSuccess:
-                return "AgentSuccess"
            case .agentIdentitiesAnswer:
                return "AgentIdentitiesAnswer"
            case .agentSignResponse:
--- a/Sources/Packages/Sources/SecretKit/Documentation.docc/Documentation.md
+++ b/Sources/Packages/Sources/SecretKit/Documentation.docc/Documentation.md
@@ -32,9 +32,3 @@ SecretKit is a collection of protocols describing secrets and stores.
 ### Authentication Persistence

 - ``PersistedAuthenticationContext``
-
-### Errors
-
- ``KeychainError``
- ``SigningError``
- ``SecurityError``
--- a/Sources/Packages/Sources/SecretKit/Erasers/AnySecretStore.swift
+++ b/Sources/Packages/Sources/SecretKit/Erasers/AnySecretStore.swift
@@ -10,10 +10,8 @@ public class AnySecretStore: SecretStore {
    private let _name: () -> String
    private let _secrets: () -> [AnySecret]
    private let _sign: (Data, AnySecret, SigningRequestProvenance) throws -> Data
-    private let _verify: (Data, Data, AnySecret) throws -> Bool
    private let _existingPersistedAuthenticationContext: (AnySecret) -> PersistedAuthenticationContext?
    private let _persistAuthentication: (AnySecret, TimeInterval) throws -> Void
-    private let _reloadSecrets: () -> Void

    private var sink: AnyCancellable?

@@ -24,10 +22,8 @@ public class AnySecretStore: SecretStore {
        _id = { secretStore.id }
        _secrets = { secretStore.secrets.map { AnySecret($0) } }
        _sign = { try secretStore.sign(data: $0, with: $1.base as! SecretStoreType.SecretType, for: $2) }
-        _verify = { try secretStore.verify(signature: $0, for: $1, with: $2.base as! SecretStoreType.SecretType) }
        _existingPersistedAuthenticationContext = { secretStore.existingPersistedAuthenticationContext(secret: $0.base as! SecretStoreType.SecretType) }
        _persistAuthentication = { try secretStore.persistAuthentication(secret: $0.base as! SecretStoreType.SecretType, forDuration: $1) }
-        _reloadSecrets = { secretStore.reloadSecrets() }
        sink = secretStore.objectWillChange.sink { _ in
            self.objectWillChange.send()
        }
@@ -53,10 +49,6 @@ public class AnySecretStore: SecretStore {
        try _sign(data, secret, provenance)
    }

-    public func verify(signature: Data, for data: Data, with secret: AnySecret) throws -> Bool {
-        try _verify(signature, data, secret)
-    }
-
    public func existingPersistedAuthenticationContext(secret: AnySecret) -> PersistedAuthenticationContext? {
        _existingPersistedAuthenticationContext(secret)
    }
@@ -65,10 +57,6 @@ public class AnySecretStore: SecretStore {
        try _persistAuthentication(secret, duration)
    }

-    public func reloadSecrets() {
-        _reloadSecrets()
-    }
-
 }

 public class AnySecretStoreModifiable: AnySecretStore, SecretStoreModifiable {
--- a/Sources/Packages/Sources/SecretKit/KeychainTypes.swift
+++ b/Sources/Packages/Sources/SecretKit/KeychainTypes.swift
@@ -1,71 +0,0 @@
-import Foundation
-
-public typealias SecurityError = Unmanaged<CFError>
-
-/// Wraps a Swift dictionary in a CFDictionary.
-/// - Parameter dictionary: The Swift dictionary to wrap.
-/// - Returns: A CFDictionary containing the keys and values.
-public func KeychainDictionary(_ dictionary: [CFString: Any]) -> CFDictionary {
-    dictionary as CFDictionary
-}
-
-public extension CFError {
-
-    /// The CFError returned when a verification operation fails.
-    static let verifyError = CFErrorCreate(nil, NSOSStatusErrorDomain as CFErrorDomain, CFIndex(errSecVerifyFailed), nil)!
-
-    /// Equality operation that only considers domain and code.
-    static func ~=(lhs: CFError, rhs: CFError) -> Bool {
-        CFErrorGetDomain(lhs) == CFErrorGetDomain(rhs) && CFErrorGetCode(lhs) == CFErrorGetCode(rhs)
-    }
-
-}
-
-/// A wrapper around an error code reported by a Keychain API.
-public struct KeychainError: Error {
-    /// The status code involved, if one was reported.
-    public let statusCode: OSStatus?
-
-    /// Initializes a KeychainError with an optional error code.
-    /// - Parameter statusCode: The status code returned by the keychain operation, if one is applicable.
-    public init(statusCode: OSStatus?) {
-        self.statusCode = statusCode
-    }
-}
-
-/// A signing-related error.
-public struct SigningError: Error {
-    /// The underlying error reported by the API, if one was returned.
-    public let error: SecurityError?
-
-    /// Initializes a SigningError with an optional SecurityError.
-    /// - Parameter statusCode: The SecurityError, if one is applicable.
-    public init(error: SecurityError?) {
-        self.error = error
-    }
-
-}
-
-public extension SecretStore {
-
-    /// Returns the appropriate keychian signature algorithm to use for a given secret.
-    /// - Parameters:
-    ///   - secret: The secret which will be used for signing.
-    ///   - allowRSA: Whether or not RSA key types should be permited.
-    /// - Returns: The appropriate algorithm.
-    func signatureAlgorithm(for secret: SecretType, allowRSA: Bool = false) -> SecKeyAlgorithm {
-        switch (secret.algorithm, secret.keySize) {
-        case (.ellipticCurve, 256):
-            return .ecdsaSignatureMessageX962SHA256
-        case (.ellipticCurve, 384):
-            return .ecdsaSignatureMessageX962SHA384
-        case (.rsa, 1024), (.rsa, 2048):
-            guard allowRSA else { fatalError() }
-            return .rsaSignatureMessagePKCS1v15SHA512
-        default:
-            fatalError()
-        }
-
-    }
-
-}
--- a/Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHCertificateHandler.swift
+++ b/Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHCertificateHandler.swift
@@ -1,120 +0,0 @@
-import Foundation
-import OSLog
-
-/// Manages storage and lookup for OpenSSH certificates.
-public class OpenSSHCertificateHandler {
-
-    private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: NSHomeDirectory())
-    private let logger = Logger()
-    private let writer = OpenSSHKeyWriter()
-    private var keyBlobsAndNames: [AnySecret: (Data, Data)] = [:]
-
-    /// Initializes an OpenSSHCertificateHandler.
-    public init() {
-    }
-
-    /// Reloads any certificates in the PublicKeys folder.
-    /// - Parameter secrets: the secrets to look up corresponding certificates for.
-    public func reloadCertificates(for secrets: [AnySecret]) {
-        guard publicKeyFileStoreController.hasAnyCertificates else {
-            logger.log("No certificates, short circuiting")
-            return
-        }
-        keyBlobsAndNames = secrets.reduce(into: [:]) { partialResult, next in
-            partialResult[next] = try? loadKeyblobAndName(for: next)
-        }
-    }
-
-    /// Whether or not the certificate handler has a certifiicate associated with a given secret.
-    /// - Parameter secret: The secret to check for a certificate.
-    /// - Returns: A boolean describing whether or not the certificate handler has a certifiicate associated with a given secret
-    public func hasCertificate<SecretType: Secret>(for secret: SecretType) -> Bool {
-        keyBlobsAndNames[AnySecret(secret)] != nil
-    }
-
-
-    /// Reconstructs a public key from a ``Data``, if that ``Data`` contains an OpenSSH certificate hash. Currently only ecdsa certificates are supported
-    /// - Parameter certBlock: The openssh certificate to extract the public key from
-    /// - Returns: A ``Data`` object containing the public key in OpenSSH wire format if the ``Data`` is an OpenSSH certificate hash, otherwise nil.
-    public func publicKeyHash(from hash: Data) -> Data? {
-        let reader = OpenSSHReader(data: hash)
-        let certType = String(decoding: reader.readNextChunk(), as: UTF8.self)
-
-        switch certType {
-        case "ecdsa-sha2-nistp256-cert-v01@openssh.com",
-            "ecdsa-sha2-nistp384-cert-v01@openssh.com",
-            "ecdsa-sha2-nistp521-cert-v01@openssh.com":
-            _ = reader.readNextChunk() // nonce
-            let curveIdentifier = reader.readNextChunk()
-            let publicKey = reader.readNextChunk()
-
-            let curveType = certType.replacingOccurrences(of: "-cert-v01@openssh.com", with: "").data(using: .utf8)!
-            return writer.lengthAndData(of: curveType) +
-                   writer.lengthAndData(of: curveIdentifier) +
-                   writer.lengthAndData(of: publicKey)
-        default:
-            return nil
-        }
-    }
-
-    /// Attempts to find an OpenSSH Certificate  that corresponds to a ``Secret``
-    /// - Parameter secret: The secret to search for a certificate with
-    /// - Returns: A (``Data``, ``Data``) tuple containing the certificate and certificate name, respectively.
-    public func keyBlobAndName<SecretType: Secret>(for secret: SecretType) throws -> (Data, Data)? {
-        keyBlobsAndNames[AnySecret(secret)]
-    }
-    
-    /// Attempts to find an OpenSSH Certificate  that corresponds to a ``Secret``
-    /// - Parameter secret: The secret to search for a certificate with
-    /// - Returns: A (``Data``, ``Data``) tuple containing the certificate and certificate name, respectively.
-    private func loadKeyblobAndName<SecretType: Secret>(for secret: SecretType) throws -> (Data, Data)? {
-        let certificatePath = publicKeyFileStoreController.sshCertificatePath(for: secret)
-        guard FileManager.default.fileExists(atPath: certificatePath) else {
-            return nil
-        }
-
-        logger.debug("Found certificate for \(secret.name)")
-        let certContent = try String(contentsOfFile:certificatePath, encoding: .utf8)
-        let certElements = certContent.trimmingCharacters(in: .whitespacesAndNewlines).components(separatedBy: " ")
-
-        guard certElements.count >= 2 else {
-            logger.warning("Certificate found for \(secret.name) but failed to load")
-            throw OpenSSHCertificateError.parsingFailed
-        }
-        guard let certDecoded = Data(base64Encoded: certElements[1] as String)  else {
-            logger.warning("Certificate found for \(secret.name) but failed to decode base64 key")
-            throw OpenSSHCertificateError.parsingFailed
-        }
-
-        if certElements.count >= 3, let certName = certElements[2].data(using: .utf8) {
-            return (certDecoded, certName)
-        } else if let certName = secret.name.data(using: .utf8) {
-            logger.info("Certificate for \(secret.name) does not have a name tag, using secret name instead")
-            return (certDecoded, certName)
-        } else {
-            throw OpenSSHCertificateError.parsingFailed
-        }
-    }
-
-}
-
-extension OpenSSHCertificateHandler {
-
-    enum OpenSSHCertificateError: LocalizedError {
-        case unsupportedType
-        case parsingFailed
-        case doesNotExist
-
-        public var errorDescription: String? {
-            switch self {
-            case .unsupportedType:
-                return "The key type was unsupported"
-            case .parsingFailed:
-                return "Failed to properly parse the SSH certificate"
-            case .doesNotExist:
-                return "Certificate does not exist"
-            }
-        }
-    }
-
-}
--- a/Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHKeyWriter.swift
+++ b/Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHKeyWriter.swift
@@ -64,10 +64,6 @@ extension OpenSSHKeyWriter {
        switch algorithm {
        case .ellipticCurve:
            return "ecdsa-sha2-nistp" + String(describing: length)
-        case .rsa:
-            // All RSA keys use the same 512 bit hash function, per
-            // https://security.stackexchange.com/questions/255074/why-are-rsa-sha2-512-and-rsa-sha2-256-supported-but-not-reported-by-ssh-q-key
-            return "rsa-sha2-512"
        }
    }

@@ -80,9 +76,6 @@ extension OpenSSHKeyWriter {
        switch algorithm {
        case .ellipticCurve:
            return "nistp" + String(describing: length)
-        case .rsa:
-            // All RSA keys use the same 512 bit hash function
-            return "rsa-sha2-512"
        }
    }

--- a/Sources/Packages/Sources/SecretKit/PublicKeyStandinFileController.swift
+++ b/Sources/Packages/Sources/SecretKit/PublicKeyStandinFileController.swift
@@ -20,10 +20,8 @@ public class PublicKeyFileStoreController {
        logger.log("Writing public keys to disk")
        if clear {
            let validPaths = Set(secrets.map { publicKeyPath(for: $0) }).union(Set(secrets.map { sshCertificatePath(for: $0) }))
-            let contentsOfDirectory = (try? FileManager.default.contentsOfDirectory(atPath: directory)) ?? []
-            let fullPathContents = contentsOfDirectory.map { "\(directory)/\($0)" }
-
-            let untracked = Set(fullPathContents)
+            let untracked = Set(try FileManager.default.contentsOfDirectory(atPath: directory)
+                .map { "\(directory)/\($0)" })
                .subtracting(validPaths)
            for path in untracked {
                try? FileManager.default.removeItem(at: URL(fileURLWithPath: path))
@@ -47,18 +45,6 @@ public class PublicKeyFileStoreController {
        return directory.appending("/").appending("\(minimalHex).pub")
    }

-    /// Short-circuit check to ship enumerating a bunch of paths if there's nothing in the cert directory.
-    public var hasAnyCertificates: Bool {
-        do {
-            return try FileManager.default
-                .contentsOfDirectory(atPath: directory)
-                .filter { $0.hasSuffix("-cert.pub") }
-                .isEmpty == false
-        } catch {
-            return false
-        }
-    }
-
    /// The path for a Secret's SSH Certificate public key.
    /// - Parameter secret: The Secret to return the path for.
    /// - Returns: The path to the SSH Certificate public key.
--- a/Sources/Packages/Sources/SecretKit/SecretStoreList.swift
+++ b/Sources/Packages/Sources/SecretKit/SecretStoreList.swift
@@ -8,7 +8,7 @@ public class SecretStoreList: ObservableObject {
    @Published public var stores: [AnySecretStore] = []
    /// A modifiable store, if one is available.
    @Published public var modifiableStore: AnySecretStoreModifiable?
-    private var cancellables: Set<AnyCancellable> = []
+    private var sinks: [AnyCancellable] = []

    /// Initializes a SecretStoreList.
    public init() {
@@ -31,19 +31,16 @@ public class SecretStoreList: ObservableObject {
        stores.reduce(false, { $0 || $1.isAvailable })
    }

-    public var allSecrets: [AnySecret] {
-        stores.flatMap(\.secrets)
-    }
-
 }

 extension SecretStoreList {

    private func addInternal(store: AnySecretStore) {
        stores.append(store)
-        store.objectWillChange.sink {
+        let sink = store.objectWillChange.sink {
            self.objectWillChange.send()
-        }.store(in: &cancellables)
+        }
+        sinks.append(sink)
    }

 }
--- a/Sources/Packages/Sources/SecretKit/Types/Secret.swift
+++ b/Sources/Packages/Sources/SecretKit/Types/Secret.swift
@@ -20,7 +20,6 @@ public protocol Secret: Identifiable, Hashable {
 public enum Algorithm: Hashable {

    case ellipticCurve
-    case rsa

    /// Initializes the Algorithm with a secAttr representation of an algorithm.
    /// - Parameter secAttr: the secAttr, represented as an NSNumber.
@@ -29,19 +28,8 @@ public enum Algorithm: Hashable {
        switch secAttrString {
        case kSecAttrKeyTypeEC:
            self = .ellipticCurve
-        case kSecAttrKeyTypeRSA:
-            self = .rsa
        default:
            fatalError()
        }
    }
-    
-    public var secAttrKeyType: CFString {
-        switch self {
-        case .ellipticCurve:
-            return kSecAttrKeyTypeEC
-        case .rsa:
-            return kSecAttrKeyTypeRSA
-        }
-    }
 }
--- a/Sources/Packages/Sources/SecretKit/Types/SecretStore.swift
+++ b/Sources/Packages/Sources/SecretKit/Types/SecretStore.swift
@@ -23,14 +23,6 @@ public protocol SecretStore: ObservableObject, Identifiable {
    /// - Returns: The signed data.
    func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> Data

-    /// Verifies that a signature is valid over a specified payload.
-    /// - Parameters:
-    ///   - signature: The signature over the data.
-    ///   - data: The data to verify the signature of.
-    ///   - secret: The secret whose signature to verify.
-    /// - Returns: Whether the signature was verified.
-    func verify(signature: Data, for data: Data, with secret: SecretType) throws -> Bool
-
    /// Checks to see if there is currently a valid persisted authentication for a given secret.
    /// - Parameters:
    ///   - secret: The ``Secret`` to check if there is a persisted authentication for.
@@ -44,9 +36,6 @@ public protocol SecretStore: ObservableObject, Identifiable {
    ///  - Note: This is used for temporarily unlocking access to a secret which would otherwise require authentication every single use. This is useful for situations where the user anticipates several rapid accesses to a authorization-guarded secret.
    func persistAuthentication(secret: SecretType, forDuration duration: TimeInterval) throws

-    /// Requests that the store reload secrets from any backing store, if neccessary.
-    func reloadSecrets()
-
 }

 /// A SecretStore that the Secretive admin app can modify.
--- a/Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift
+++ b/Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift
@@ -1,5 +1,4 @@
 import Foundation
-import Combine
 import Security
 import CryptoTokenKit
 import LocalAuthentication
@@ -25,7 +24,7 @@ extension SecureEnclave {
        /// Initializes a Store.
        public init() {
            DistributedNotificationCenter.default().addObserver(forName: .secretStoreUpdated, object: nil, queue: .main) { _ in
-                self.reloadSecretsInternal(notifyAgent: false)
+                self.reloadSecrets(notifyAgent: false)
            }
            loadSecrets()
        }
@@ -49,7 +48,7 @@ extension SecureEnclave {
                throw error.takeRetainedValue() as Error
            }

-            let attributes = KeychainDictionary([
+            let attributes = [
                kSecAttrLabel: name,
                kSecAttrKeyType: Constants.keyType,
                kSecAttrTokenID: kSecAttrTokenIDSecureEnclave,
@@ -58,7 +57,7 @@ extension SecureEnclave {
                    kSecAttrIsPermanent: true,
                    kSecAttrAccessControl: access
                ]
-            ])
+            ] as CFDictionary

            var createKeyError: SecurityError?
            let keypair = SecKeyCreateRandomKey(attributes, &createKeyError)
@@ -69,39 +68,39 @@ extension SecureEnclave {
                throw KeychainError(statusCode: nil)
            }
            try savePublicKey(publicKey, name: name)
-            reloadSecretsInternal()
+            reloadSecrets()
        }

        public func delete(secret: Secret) throws {
-            let deleteAttributes = KeychainDictionary([
+            let deleteAttributes = [
                kSecClass: kSecClassKey,
                kSecAttrApplicationLabel: secret.id as CFData
-            ])
+            ] as CFDictionary
            let status = SecItemDelete(deleteAttributes)
            if status != errSecSuccess {
                throw KeychainError(statusCode: status)
            }
-            reloadSecretsInternal()
+            reloadSecrets()
        }

        public func update(secret: Secret, name: String) throws {
-            let updateQuery = KeychainDictionary([
+            let updateQuery = [
                kSecClass: kSecClassKey,
                kSecAttrApplicationLabel: secret.id as CFData
-            ])
+            ] as CFDictionary

-            let updatedAttributes = KeychainDictionary([
+            let updatedAttributes = [
                kSecAttrLabel: name,
-            ])
+            ] as CFDictionary

            let status = SecItemUpdate(updateQuery, updatedAttributes)
            if status != errSecSuccess {
                throw KeychainError(statusCode: status)
            }
-            reloadSecretsInternal()
+            reloadSecrets()
        }
        
-        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) throws -> Data {
+        public func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> Data {
            let context: LAContext
            if let existing = persistedAuthenticationContexts[secret], existing.valid {
                context = existing.context
@@ -111,7 +110,7 @@ extension SecureEnclave {
                context = newContext
            }
            context.localizedReason = "sign a request from \"\(provenance.origin.displayName)\" using secret \"\(secret.name)\""
-            let attributes = KeychainDictionary([
+            let attributes = [
                kSecClass: kSecClassKey,
                kSecAttrKeyClass: kSecAttrKeyClassPrivate,
                kSecAttrApplicationLabel: secret.id as CFData,
@@ -120,7 +119,7 @@ extension SecureEnclave {
                kSecAttrApplicationTag: Constants.keyTag,
                kSecUseAuthenticationContext: context,
                kSecReturnRef: true
-                ])
+                ] as CFDictionary
            var untyped: CFTypeRef?
            let status = SecItemCopyMatching(attributes, &untyped)
            if status != errSecSuccess {
@@ -138,41 +137,6 @@ extension SecureEnclave {
            return signature as Data
        }

-        public func verify(signature: Data, for data: Data, with secret: Secret) throws -> Bool {
-            let context = LAContext()
-            context.localizedReason = "verify a signature using secret \"\(secret.name)\""
-            context.localizedCancelTitle = "Deny"
-            let attributes = KeychainDictionary([
-                kSecClass: kSecClassKey,
-                kSecAttrKeyClass: kSecAttrKeyClassPrivate,
-                kSecAttrApplicationLabel: secret.id as CFData,
-                kSecAttrKeyType: Constants.keyType,
-                kSecAttrTokenID: kSecAttrTokenIDSecureEnclave,
-                kSecAttrApplicationTag: Constants.keyTag,
-                kSecUseAuthenticationContext: context,
-                kSecReturnRef: true
-                ])
-            var verifyError: SecurityError?
-            var untyped: CFTypeRef?
-            let status = SecItemCopyMatching(attributes, &untyped)
-            if status != errSecSuccess {
-                throw KeychainError(statusCode: status)
-            }
-            guard let untypedSafe = untyped else {
-                throw KeychainError(statusCode: errSecSuccess)
-            }
-            let key = untypedSafe as! SecKey
-            let verified = SecKeyVerifySignature(key, .ecdsaSignatureMessageX962SHA256, data as CFData, signature as CFData, &verifyError)
-            if !verified, let verifyError {
-                if verifyError.takeUnretainedValue() ~= .verifyError {
-                    return false
-                } else {
-                    throw SigningError(error: verifyError)
-                }
-            }
-            return verified
-        }
-
        public func existingPersistedAuthenticationContext(secret: Secret) -> PersistedAuthenticationContext? {
            guard let persisted = persistedAuthenticationContexts[secret], persisted.valid else { return nil }
            return persisted
@@ -199,10 +163,6 @@ extension SecureEnclave {
            }
        }

-        public func reloadSecrets() {
-            reloadSecretsInternal(notifyAgent: false)
-        }
-
    }

 }
@@ -211,21 +171,18 @@ extension SecureEnclave.Store {

    /// Reloads all secrets from the store.
    /// - Parameter notifyAgent: A boolean indicating whether a distributed notification should be posted, notifying other processes (ie, the SecretAgent) to reload their stores as well.
-    private func reloadSecretsInternal(notifyAgent: Bool = true) {
-        let before = secrets
+    private func reloadSecrets(notifyAgent: Bool = true) {
        secrets.removeAll()
        loadSecrets()
-        if secrets != before {
        NotificationCenter.default.post(name: .secretStoreReloaded, object: self)
        if notifyAgent {
            DistributedNotificationCenter.default().postNotificationName(.secretStoreUpdated, object: nil, deliverImmediately: true)
        }
    }
-    }

    /// Loads all secrets from the store.
    private func loadSecrets() {
-        let publicAttributes = KeychainDictionary([
+        let publicAttributes = [
            kSecClass: kSecClassKey,
            kSecAttrKeyType: SecureEnclave.Constants.keyType,
            kSecAttrApplicationTag: SecureEnclave.Constants.keyTag,
@@ -233,11 +190,11 @@ extension SecureEnclave.Store {
            kSecReturnRef: true,
            kSecMatchLimit: kSecMatchLimitAll,
            kSecReturnAttributes: true
-            ])
+            ] as CFDictionary
        var publicUntyped: CFTypeRef?
        SecItemCopyMatching(publicAttributes, &publicUntyped)
        guard let publicTyped = publicUntyped as? [[CFString: Any]] else { return }
-        let privateAttributes = KeychainDictionary([
+        let privateAttributes = [
            kSecClass: kSecClassKey,
            kSecAttrKeyType: SecureEnclave.Constants.keyType,
            kSecAttrApplicationTag: SecureEnclave.Constants.keyTag,
@@ -245,7 +202,7 @@ extension SecureEnclave.Store {
            kSecReturnRef: true,
            kSecMatchLimit: kSecMatchLimitAll,
            kSecReturnAttributes: true
-            ])
+            ] as CFDictionary
        var privateUntyped: CFTypeRef?
        SecItemCopyMatching(privateAttributes, &privateUntyped)
        guard let privateTyped = privateUntyped as? [[CFString: Any]] else { return }
@@ -283,7 +240,7 @@ extension SecureEnclave.Store {
    ///   - publicKey: The public key to save.
    ///   - name: A user-facing name for the key.
    private func savePublicKey(_ publicKey: SecKey, name: String) throws {
-        let attributes = KeychainDictionary([
+        let attributes = [
            kSecClass: kSecClassKey,
            kSecAttrKeyType: SecureEnclave.Constants.keyType,
            kSecAttrKeyClass: kSecAttrKeyClassPublic,
@@ -292,15 +249,37 @@ extension SecureEnclave.Store {
            kSecAttrIsPermanent: true,
            kSecReturnData: true,
            kSecAttrLabel: name
-            ])
+            ] as CFDictionary
        let status = SecItemAdd(attributes, nil)
        if status != errSecSuccess {
-            throw KeychainError(statusCode: status)
+            throw SecureEnclave.KeychainError(statusCode: status)
        }
    }

 }

+extension SecureEnclave {
+
+    /// A wrapper around an error code reported by a Keychain API.
+    public struct KeychainError: Error {
+        /// The status code involved, if one was reported.
+        public let statusCode: OSStatus?
+    }
+
+    /// A signing-related error.
+    public struct SigningError: Error {
+        /// The underlying error reported by the API, if one was returned.
+        public let error: SecurityError?
+    }
+
+}
+
+extension SecureEnclave {
+
+    public typealias SecurityError = Unmanaged<CFError>
+
+}
+
 extension SecureEnclave {

    enum Constants {
--- a/Sources/Packages/Sources/SmartCardSecretKit/Documentation.docc/SmartCard.md
+++ b/Sources/Packages/Sources/SmartCardSecretKit/Documentation.docc/SmartCard.md
@@ -6,3 +6,9 @@

 - ``Secret``
 - ``Store``
+
+### Errors
+
+- ``KeychainError``
+- ``SigningError``
+- ``SecurityError``
--- a/Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift
+++ b/Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift
@@ -1,5 +1,4 @@
 import Foundation
-import Combine
 import Security
 import CryptoTokenKit
 import LocalAuthentication
@@ -45,19 +44,19 @@ extension SmartCard {
            fatalError("Keys must be deleted on the smart card.")
        }

-        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) throws -> Data {
+        public func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> Data {
            guard let tokenID = tokenID else { fatalError() }
            let context = LAContext()
            context.localizedReason = "sign a request from \"\(provenance.origin.displayName)\" using secret \"\(secret.name)\""
            context.localizedCancelTitle = "Deny"
-            let attributes = KeychainDictionary([
+            let attributes = [
                kSecClass: kSecClassKey,
                kSecAttrKeyClass: kSecAttrKeyClassPrivate,
                kSecAttrApplicationLabel: secret.id as CFData,
                kSecAttrTokenID: tokenID,
                kSecUseAuthenticationContext: context,
                kSecReturnRef: true
-            ])
+            ] as CFDictionary
            var untyped: CFTypeRef?
            let status = SecItemCopyMatching(attributes, &untyped)
            if status != errSecSuccess {
@@ -68,53 +67,26 @@ extension SmartCard {
            }
            let key = untypedSafe as! SecKey
            var signError: SecurityError?
-            guard let signature = SecKeyCreateSignature(key, signatureAlgorithm(for: secret, allowRSA: true), data as CFData, &signError) else {
+            let signatureAlgorithm: SecKeyAlgorithm
+            switch (secret.algorithm, secret.keySize) {
+            case (.ellipticCurve, 256):
+                signatureAlgorithm = .ecdsaSignatureMessageX962SHA256
+            case (.ellipticCurve, 384):
+                signatureAlgorithm = .ecdsaSignatureMessageX962SHA384
+            default:
+                fatalError()
+            }
+            guard let signature = SecKeyCreateSignature(key, signatureAlgorithm, data as CFData, &signError) else {
                throw SigningError(error: signError)
            }
            return signature as Data
        }

-        public func verify(signature: Data, for data: Data, with secret: Secret) throws -> Bool {
-            let attributes = KeychainDictionary([
-                kSecAttrKeyType: secret.algorithm.secAttrKeyType,
-                kSecAttrKeySizeInBits: secret.keySize,
-                kSecAttrKeyClass: kSecAttrKeyClassPublic
-            ])
-            var verifyError: SecurityError?
-            let untyped: CFTypeRef? = SecKeyCreateWithData(secret.publicKey as CFData, attributes, &verifyError)
-            guard let untypedSafe = untyped else {
-                throw KeychainError(statusCode: errSecSuccess)
-            }
-            let key = untypedSafe as! SecKey
-            let verified = SecKeyVerifySignature(key, signatureAlgorithm(for: secret, allowRSA: true), data as CFData, signature as CFData, &verifyError)
-            if !verified, let verifyError {
-                if verifyError.takeUnretainedValue() ~= .verifyError {
-                    return false
-                } else {
-                    throw SigningError(error: verifyError)
-                }
-            }
-            return verified
-        }
-
-        public func existingPersistedAuthenticationContext(secret: Secret) -> PersistedAuthenticationContext? {
+        public func existingPersistedAuthenticationContext(secret: SmartCard.Secret) -> PersistedAuthenticationContext? {
            nil
        }

-        public func persistAuthentication(secret: Secret, forDuration: TimeInterval) throws {
-        }
-
-        /// Reloads all secrets from the store.
-        public func reloadSecrets() {
-            DispatchQueue.main.async {
-                self.isAvailable = self.tokenID != nil
-                let before = self.secrets
-                self.secrets.removeAll()
-                self.loadSecrets()
-                if self.secrets != before {
-                    NotificationCenter.default.post(name: .secretStoreReloaded, object: self)
-                }
-            }
+        public func persistAuthentication(secret: SmartCard.Secret, forDuration: TimeInterval) throws {
        }

    }
@@ -130,6 +102,15 @@ extension SmartCard.Store {
        reloadSecrets()
    }

+    /// Reloads all secrets from the store.
+    private func reloadSecrets() {
+        DispatchQueue.main.async {
+            self.isAvailable = self.tokenID != nil
+            self.secrets.removeAll()
+            self.loadSecrets()
+        }
+    }
+
    /// Loads all secrets from the store.
    private func loadSecrets() {
        guard let tokenID = tokenID else { return }
@@ -151,17 +132,18 @@ extension SmartCard.Store {
            }
        }

-        let attributes = KeychainDictionary([
+        let attributes = [
            kSecClass: kSecClassKey,
            kSecAttrTokenID: tokenID,
+            kSecAttrKeyType: kSecAttrKeyTypeEC, // Restrict to EC
            kSecReturnRef: true,
            kSecMatchLimit: kSecMatchLimitAll,
            kSecReturnAttributes: true
-        ])
+        ] as CFDictionary
        var untyped: CFTypeRef?
        SecItemCopyMatching(attributes, &untyped)
        guard let typed = untyped as? [[CFString: Any]] else { return }
-        let wrapped = typed.map {
+        let wrapped: [SmartCard.Secret] = typed.map {
            let name = $0[kSecAttrLabel] as? String ?? "Unnamed"
            let tokenID = $0[kSecAttrApplicationLabel] as! Data
            let algorithm = Algorithm(secAttr: $0[kSecAttrKeyType] as! NSNumber)
@@ -177,88 +159,6 @@ extension SmartCard.Store {

 }

-
-// MARK: Smart Card specific encryption/decryption/verification
-extension SmartCard.Store {
-
-    /// Encrypts a payload with a specified key.
-    /// - Parameters:
-    ///   - data: The payload to encrypt.
-    ///   - secret: The secret to encrypt with.
-    /// - Returns: The encrypted data.
-    /// - Warning: Encryption functions are deliberately only exposed on a library level, and are not exposed in Secretive itself to prevent users from data loss. Any pull requests which expose this functionality in the app will not be merged.
-    public func encrypt(data: Data, with secret: SecretType) throws -> Data {
-        let context = LAContext()
-        context.localizedReason = "encrypt data using secret \"\(secret.name)\""
-        context.localizedCancelTitle = "Deny"
-        let attributes = KeychainDictionary([
-            kSecAttrKeyType: secret.algorithm.secAttrKeyType,
-            kSecAttrKeySizeInBits: secret.keySize,
-            kSecAttrKeyClass: kSecAttrKeyClassPublic,
-            kSecUseAuthenticationContext: context
-        ])
-        var encryptError: SecurityError?
-        let untyped: CFTypeRef? = SecKeyCreateWithData(secret.publicKey as CFData, attributes, &encryptError)
-        guard let untypedSafe = untyped else {
-            throw KeychainError(statusCode: errSecSuccess)
-        }
-        let key = untypedSafe as! SecKey
-        guard let signature = SecKeyCreateEncryptedData(key, encryptionAlgorithm(for: secret), data as CFData, &encryptError) else {
-            throw SigningError(error: encryptError)
-        }
-        return signature as Data
-    }
-
-    /// Decrypts a payload with a specified key.
-    /// - Parameters:
-    ///   - data: The payload to decrypt.
-    ///   - secret: The secret to decrypt with.
-    /// - Returns: The decrypted data.
-    /// - Warning: Encryption functions are deliberately only exposed on a library level, and are not exposed in Secretive itself to prevent users from data loss. Any pull requests which expose this functionality in the app will not be merged.
-    public func decrypt(data: Data, with secret: SecretType) throws -> Data {
-        guard let tokenID = tokenID else { fatalError() }
-        let context = LAContext()
-        context.localizedReason = "decrypt data using secret \"\(secret.name)\""
-        context.localizedCancelTitle = "Deny"
-        let attributes = KeychainDictionary([
-            kSecClass: kSecClassKey,
-            kSecAttrKeyClass: kSecAttrKeyClassPrivate,
-            kSecAttrApplicationLabel: secret.id as CFData,
-            kSecAttrTokenID: tokenID,
-            kSecUseAuthenticationContext: context,
-            kSecReturnRef: true
-        ])
-        var untyped: CFTypeRef?
-        let status = SecItemCopyMatching(attributes, &untyped)
-        if status != errSecSuccess {
-            throw KeychainError(statusCode: status)
-        }
-        guard let untypedSafe = untyped else {
-            throw KeychainError(statusCode: errSecSuccess)
-        }
-        let key = untypedSafe as! SecKey
-        var encryptError: SecurityError?
-        guard let signature = SecKeyCreateDecryptedData(key, encryptionAlgorithm(for: secret), data as CFData, &encryptError) else {
-            throw SigningError(error: encryptError)
-        }
-        return signature as Data
-    }
-
-    private func encryptionAlgorithm(for secret: SecretType) -> SecKeyAlgorithm {
-        switch (secret.algorithm, secret.keySize) {
-        case (.ellipticCurve, 256):
-            return .eciesEncryptionCofactorVariableIVX963SHA256AESGCM
-        case (.ellipticCurve, 384):
-            return .eciesEncryptionCofactorVariableIVX963SHA256AESGCM
-        case (.rsa, 1024), (.rsa, 2048):
-            return .rsaEncryptionOAEPSHA512AESGCM
-        default:
-            fatalError()
-        }
-    }
-
-}
-
 extension TKTokenWatcher {

    /// All available tokens, excluding the Secure Enclave.
@@ -267,3 +167,25 @@ extension TKTokenWatcher {
    }

 }
+
+extension SmartCard {
+
+    /// A wrapper around an error code reported by a Keychain API.
+    public struct KeychainError: Error {
+        /// The status code involved.
+        public let statusCode: OSStatus
+    }
+
+    /// A signing-related error.
+    public struct SigningError: Error {
+        /// The underlying error reported by the API, if one was returned.
+        public let error: SecurityError?
+    }
+
+}
+
+extension SmartCard {
+
+    public typealias SecurityError = Unmanaged<CFError>
+
+}
--- a/Sources/Packages/Tests/SecretAgentKitTests/AgentTests.swift
+++ b/Sources/Packages/Tests/SecretAgentKitTests/AgentTests.swift
@@ -61,17 +61,8 @@ class AgentTests: XCTestCase {
        var rs = r
        rs.append(s)
        let signature = try! P256.Signing.ECDSASignature(rawRepresentation: rs)
-        let referenceValid = try! P256.Signing.PublicKey(x963Representation: Constants.Secrets.ecdsa256Secret.publicKey).isValidSignature(signature, for: dataToSign)
-        let store = list.stores.first!
-        let derVerifies = try! store.verify(signature: signature.derRepresentation, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa256Secret))
-        let invalidRandomSignature = try? store.verify(signature: "invalid".data(using: .utf8)!, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa256Secret))
-        let invalidRandomData = try? store.verify(signature: signature.derRepresentation, for: "invalid".data(using: .utf8)!, with: AnySecret(Constants.Secrets.ecdsa256Secret))
-        let invalidWrongKey = try? store.verify(signature: signature.derRepresentation, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa384Secret))
-        XCTAssertTrue(referenceValid)
-        XCTAssertTrue(derVerifies)
-        XCTAssert(invalidRandomSignature == false)
-        XCTAssert(invalidRandomData == false)
-        XCTAssert(invalidWrongKey == false)
+        let valid = try! P256.Signing.PublicKey(x963Representation: Constants.Secrets.ecdsa256Secret.publicKey).isValidSignature(signature, for: dataToSign)
+        XCTAssertTrue(valid)
    }

    // MARK: Witness protocol
--- a/Sources/Packages/Tests/SecretAgentKitTests/StubStore.swift
+++ b/Sources/Packages/Tests/SecretAgentKitTests/StubStore.swift
@@ -27,7 +27,7 @@ extension Stub {
                                                flags,
                                                nil) as Any

-            let attributes = KeychainDictionary([
+            let attributes = [
                kSecAttrLabel: name,
                kSecAttrKeyType: kSecAttrKeyTypeECSECPrimeRandom,
                kSecAttrKeySizeInBits: size,
@@ -35,10 +35,11 @@ extension Stub {
                    kSecAttrIsPermanent: true,
                    kSecAttrAccessControl: access
                ]
-                ])
+                ] as CFDictionary

-            let privateKey = SecKeyCreateRandomKey(attributes, nil)!
-            let publicKey = SecKeyCopyPublicKey(privateKey)!
+            var privateKey: SecKey! = nil
+            var publicKey: SecKey! = nil
+            SecKeyGeneratePair(attributes, &publicKey, &privateKey)
            let publicAttributes = SecKeyCopyAttributes(publicKey) as! [CFString: Any]
            let privateAttributes = SecKeyCopyAttributes(privateKey) as! [CFString: Any]
            let publicData = (publicAttributes[kSecValueData] as! Data)
@@ -52,36 +53,22 @@ extension Stub {
            guard !shouldThrow else {
                throw NSError(domain: "test", code: 0, userInfo: nil)
            }
-            let privateKey = SecKeyCreateWithData(secret.privateKey as CFData, KeychainDictionary([
+            let privateKey = SecKeyCreateWithData(secret.privateKey as CFData, [
                kSecAttrKeyType: kSecAttrKeyTypeECSECPrimeRandom,
                kSecAttrKeySizeInBits: secret.keySize,
                kSecAttrKeyClass: kSecAttrKeyClassPrivate
-                ])
+                ] as CFDictionary
                , nil)!
-            return SecKeyCreateSignature(privateKey, signatureAlgorithm(for: secret), data as CFData, nil)! as Data
+            let signatureAlgorithm: SecKeyAlgorithm
+            switch secret.keySize {
+            case 256:
+                signatureAlgorithm = .ecdsaSignatureMessageX962SHA256
+            case 384:
+                signatureAlgorithm = .ecdsaSignatureMessageX962SHA384
+            default:
+                fatalError()
            }
-
-        public func verify(signature: Data, for data: Data, with secret: Stub.Secret) throws -> Bool {
-            let attributes = KeychainDictionary([
-                kSecAttrKeyType: secret.algorithm.secAttrKeyType,
-                kSecAttrKeySizeInBits: secret.keySize,
-                kSecAttrKeyClass: kSecAttrKeyClassPublic
-            ])
-            var verifyError: Unmanaged<CFError>?
-            let untyped: CFTypeRef? = SecKeyCreateWithData(secret.publicKey as CFData, attributes, &verifyError)
-            guard let untypedSafe = untyped else {
-                throw NSError(domain: "test", code: 0, userInfo: nil)
-            }
-            let key = untypedSafe as! SecKey
-            let verified = SecKeyVerifySignature(key, signatureAlgorithm(for: secret), data as CFData, signature as CFData, &verifyError)
-            if let verifyError {
-                if verifyError.takeUnretainedValue() ~= .verifyError {
-                    return false
-                } else {
-                    throw NSError(domain: "test", code: 0, userInfo: nil)
-                }
-            }
-            return verified
+            return SecKeyCreateSignature(privateKey, signatureAlgorithm, data as CFData, nil)! as Data
        }

        public func existingPersistedAuthenticationContext(secret: Stub.Secret) -> PersistedAuthenticationContext? {
@@ -91,9 +78,6 @@ extension Stub {
        public func persistAuthentication(secret: Stub.Secret, forDuration duration: TimeInterval) throws {
        }

-        public func reloadSecrets() {
-        }
-
    }

 }
--- a/Sources/SecretAgent/AppDelegate.swift
+++ b/Sources/SecretAgent/AppDelegate.swift
@@ -34,9 +34,9 @@ class AppDelegate: NSObject, NSApplicationDelegate {
            self.socketController.handler = self.agent.handle(reader:writer:)
        }
        NotificationCenter.default.addObserver(forName: .secretStoreReloaded, object: nil, queue: .main) { [self] _ in
-            try? publicKeyFileStoreController.generatePublicKeys(for: storeList.allSecrets, clear: true)
+            try? publicKeyFileStoreController.generatePublicKeys(for: storeList.stores.flatMap({ $0.secrets }), clear: true)
        }
-        try? publicKeyFileStoreController.generatePublicKeys(for: storeList.allSecrets, clear: true)
+        try? publicKeyFileStoreController.generatePublicKeys(for: storeList.stores.flatMap({ $0.secrets }), clear: true)
        notifier.prompt()
        updateSink = updater.$update.sink { update in
            guard let update = update else { return }
--- a/Sources/Secretive.xcodeproj/project.pbxproj
+++ b/Sources/Secretive.xcodeproj/project.pbxproj
@@ -31,7 +31,6 @@
 		50617D8A23FCE48E0099B055 /* Preview Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 50617D8923FCE48E0099B055 /* Preview Assets.xcassets */; };
 		50617D9923FCE48E0099B055 /* SecretiveTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50617D9823FCE48E0099B055 /* SecretiveTests.swift */; };
 		50617DD223FCEFA90099B055 /* PreviewStore.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50617DD123FCEFA90099B055 /* PreviewStore.swift */; };
-		5065E313295517C500E16645 /* ToolbarButtonStyle.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5065E312295517C500E16645 /* ToolbarButtonStyle.swift */; };
 		5066A6C22516F303004B5A36 /* SetupView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5066A6C12516F303004B5A36 /* SetupView.swift */; };
 		5066A6C82516FE6E004B5A36 /* CopyableView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5066A6C72516FE6E004B5A36 /* CopyableView.swift */; };
 		5066A6F7251829B1004B5A36 /* ShellConfigurationController.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5066A6F6251829B1004B5A36 /* ShellConfigurationController.swift */; };
@@ -124,7 +123,6 @@
 		50617D9823FCE48E0099B055 /* SecretiveTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SecretiveTests.swift; sourceTree = "<group>"; };
 		50617D9A23FCE48E0099B055 /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
 		50617DD123FCEFA90099B055 /* PreviewStore.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = PreviewStore.swift; sourceTree = "<group>"; };
-		5065E312295517C500E16645 /* ToolbarButtonStyle.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ToolbarButtonStyle.swift; sourceTree = "<group>"; };
 		5066A6C12516F303004B5A36 /* SetupView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SetupView.swift; sourceTree = "<group>"; };
 		5066A6C72516FE6E004B5A36 /* CopyableView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = CopyableView.swift; sourceTree = "<group>"; };
 		5066A6F6251829B1004B5A36 /* ShellConfigurationController.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ShellConfigurationController.swift; sourceTree = "<group>"; };
@@ -266,7 +264,6 @@
 			isa = PBXGroup;
 			children = (
 				50617D8423FCE48E0099B055 /* ContentView.swift */,
-				5065E312295517C500E16645 /* ToolbarButtonStyle.swift */,
 				5079BA0E250F29BF00EA86F4 /* StoreListView.swift */,
 				50153E21250DECA300525160 /* SecretListItemView.swift */,
 				50C385A42407A76D00AF2719 /* SecretDetailView.swift */,
@@ -478,7 +475,6 @@
 				2C4A9D2F2636FFD3008CC8E2 /* RenameSecretView.swift in Sources */,
 				5091D2BC25183B830049FD9B /* ApplicationDirectoryController.swift in Sources */,
 				5066A6C22516F303004B5A36 /* SetupView.swift in Sources */,
-				5065E313295517C500E16645 /* ToolbarButtonStyle.swift in Sources */,
 				50617D8523FCE48E0099B055 /* ContentView.swift in Sources */,
 				50571E0324393C2600F76F6C /* JustUpdatedChecker.swift in Sources */,
 				5079BA0F250F29BF00EA86F4 /* StoreListView.swift in Sources */,
@@ -701,7 +697,7 @@
 				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES;
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				CODE_SIGN_ENTITLEMENTS = Secretive/Secretive.entitlements;
-				CODE_SIGN_IDENTITY = "Developer ID Application";
+				CODE_SIGN_IDENTITY = "";
 				CODE_SIGN_STYLE = Manual;
 				COMBINE_HIDPI_IMAGES = YES;
 				CURRENT_PROJECT_VERSION = 1;
@@ -717,7 +713,7 @@
 				MARKETING_VERSION = 1;
 				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.Host;
 				PRODUCT_NAME = "$(TARGET_NAME)";
-				PROVISIONING_PROFILE_SPECIFIER = "Secretive - Host";
+				PROVISIONING_PROFILE_SPECIFIER = "";
 				SWIFT_VERSION = 5.0;
 			};
 			name = Release;
@@ -834,10 +830,13 @@
 			buildSettings = {
 				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES;
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
+				CODE_SIGN_ENTITLEMENTS = Secretive/Secretive.entitlements;
+				CODE_SIGN_IDENTITY = "";
 				CODE_SIGN_STYLE = Manual;
 				COMBINE_HIDPI_IMAGES = YES;
 				CURRENT_PROJECT_VERSION = 1;
 				DEVELOPMENT_ASSET_PATHS = "\"Secretive/Preview Content\"";
+				DEVELOPMENT_TEAM = Z72PRUAWF6;
 				ENABLE_HARDENED_RUNTIME = NO;
 				ENABLE_PREVIEWS = YES;
 				INFOPLIST_FILE = Secretive/Info.plist;
@@ -848,6 +847,7 @@
 				MARKETING_VERSION = 1;
 				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.Host;
 				PRODUCT_NAME = "$(TARGET_NAME)";
+				PROVISIONING_PROFILE_SPECIFIER = "";
 				SWIFT_VERSION = 5.0;
 			};
 			name = Test;
@@ -878,9 +878,12 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
+				CODE_SIGN_ENTITLEMENTS = SecretAgent/SecretAgent.entitlements;
+				CODE_SIGN_IDENTITY = "";
 				CODE_SIGN_STYLE = Manual;
 				COMBINE_HIDPI_IMAGES = YES;
 				DEVELOPMENT_ASSET_PATHS = "\"SecretAgent/Preview Content\"";
+				DEVELOPMENT_TEAM = Z72PRUAWF6;
 				ENABLE_HARDENED_RUNTIME = YES;
 				ENABLE_PREVIEWS = YES;
 				INFOPLIST_FILE = SecretAgent/Info.plist;
@@ -891,6 +894,8 @@
 				MARKETING_VERSION = 1;
 				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretAgent;
 				PRODUCT_NAME = "$(TARGET_NAME)";
+				PROVISIONING_PROFILE_SPECIFIER = "";
+				SKIP_INSTALL = YES;
 				SWIFT_VERSION = 5.0;
 			};
 			name = Test;
@@ -900,6 +905,7 @@
 			buildSettings = {
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				CODE_SIGN_ENTITLEMENTS = SecretAgent/SecretAgent.entitlements;
+				CODE_SIGN_IDENTITY = "Apple Development";
 				CODE_SIGN_STYLE = Automatic;
 				COMBINE_HIDPI_IMAGES = YES;
 				DEVELOPMENT_ASSET_PATHS = "\"SecretAgent/Preview Content\"";
@@ -914,6 +920,8 @@
 				MARKETING_VERSION = 1;
 				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretAgent;
 				PRODUCT_NAME = "$(TARGET_NAME)";
+				PROVISIONING_PROFILE_SPECIFIER = "";
+				SKIP_INSTALL = YES;
 				SWIFT_VERSION = 5.0;
 			};
 			name = Debug;
@@ -923,7 +931,7 @@
 			buildSettings = {
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
 				CODE_SIGN_ENTITLEMENTS = SecretAgent/SecretAgent.entitlements;
-				CODE_SIGN_IDENTITY = "Developer ID Application";
+				CODE_SIGN_IDENTITY = "";
 				CODE_SIGN_STYLE = Manual;
 				COMBINE_HIDPI_IMAGES = YES;
 				DEVELOPMENT_ASSET_PATHS = "\"SecretAgent/Preview Content\"";
@@ -938,7 +946,8 @@
 				MARKETING_VERSION = 1;
 				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretAgent;
 				PRODUCT_NAME = "$(TARGET_NAME)";
-				PROVISIONING_PROFILE_SPECIFIER = "Secretive - Secret Agent";
+				PROVISIONING_PROFILE_SPECIFIER = "";
+				SKIP_INSTALL = YES;
 				SWIFT_VERSION = 5.0;
 			};
 			name = Release;
--- a/Sources/Secretive.xcodeproj/xcshareddata/xcschemes/Secretive.xcscheme
+++ b/Sources/Secretive.xcodeproj/xcshareddata/xcschemes/Secretive.xcscheme
@@ -75,7 +75,6 @@
      ignoresPersistentStateOnLaunch = "NO"
      debugDocumentVersioning = "YES"
      debugServiceExtension = "internal"
-      enableGPUValidationMode = "1"
      allowLocationSimulation = "YES">
      <BuildableProductRunnable
         runnableDebuggingMode = "0">
--- a/Content/PreviewStore.swift
+++ b/Content/PreviewStore.swift
@@ -40,10 +40,6 @@ extension Preview {
            return data
        }

-        func verify(signature data: Data, for signature: Data, with secret: Preview.Secret) throws -> Bool {
-            true
-        }
-
        func existingPersistedAuthenticationContext(secret: Preview.Secret) -> PersistedAuthenticationContext? {
            nil
        }
@@ -51,9 +47,6 @@ extension Preview {
        func persistAuthentication(secret: Preview.Secret, forDuration duration: TimeInterval) throws {
        }

-        func reloadSecrets() {
-        }
-
    }

    class StoreModifiable: Store, SecretStoreModifiable {
--- a/Sources/Secretive/Views/ContentView.swift
+++ b/Sources/Secretive/Views/ContentView.swift
@@ -9,9 +9,6 @@ struct ContentView<UpdaterType: UpdaterProtocol, AgentStatusCheckerType: AgentSt
    @Binding var showingCreation: Bool
    @Binding var runningSetup: Bool
    @Binding var hasRunSetup: Bool
-    @State var showingAgentInfo = false
-    @State var activeSecret: AnySecret.ID?
-    @Environment(\.colorScheme) var colorScheme

    @EnvironmentObject private var storeList: SecretStoreList
    @EnvironmentObject private var updater: UpdaterType
@@ -23,17 +20,17 @@ struct ContentView<UpdaterType: UpdaterProtocol, AgentStatusCheckerType: AgentSt
    var body: some View {
        VStack {
            if storeList.anyAvailable {
-                StoreListView(activeSecret: $activeSecret)
+                StoreListView(showingCreation: $showingCreation)
            } else {
                NoStoresView()
            }
        }
        .frame(minWidth: 640, minHeight: 320)
        .toolbar {
-            toolbarItem(updateNoticeView, id: "update")
-            toolbarItem(runningOrRunSetupView, id: "setup")
-            toolbarItem(appPathNoticeView, id: "appPath")
-            toolbarItem(newItemView, id: "new")
+            updateNotice
+            setupNotice
+            appPathNotice
+            newItem
        }
        .sheet(isPresented: $runningSetup) {
            SetupView(visible: $runningSetup, setupComplete: $hasRunSetup)
@@ -44,42 +41,26 @@ struct ContentView<UpdaterType: UpdaterProtocol, AgentStatusCheckerType: AgentSt

 extension ContentView {

-
-    func toolbarItem(_ view: some View, id: String) -> ToolbarItem<String, some View> {
-        ToolbarItem(id: id) { view }
+    var updateNotice: ToolbarItem<Void, AnyView> {
+        guard let update = updater.update else {
+            return ToolbarItem { AnyView(EmptyView()) }
        }
-
-    var needsSetup: Bool {
-        (runningSetup || !hasRunSetup || !agentStatusChecker.running) && !agentStatusChecker.developmentBuild
-    }
-
-    /// Item either showing a "everything's good, here's more info" or "something's wrong, re-run setup" message
-    /// These two are mutually exclusive
-    @ViewBuilder
-    var runningOrRunSetupView: some View {
-        if needsSetup {
-            setupNoticeView
-        } else {
-            runningNoticeView
-        }
-    }
-
-    var updateNoticeContent: (String, Color)? {
-        guard let update = updater.update else { return nil }
+        let color: Color
+        let text: String
        if update.critical {
-            return ("Critical Security Update Required", .red)
+            text = "Critical Security Update Required"
+            color = .red
        } else {
            if updater.testBuild {
-                return ("Test Build", .blue)
+                text = "Test Build"
+                color = .blue
            } else {
-                return ("Update Available", .orange)
+                text = "Update Available"
+                color = .orange
            }
        }
-    }
-
-    @ViewBuilder
-    var updateNoticeView: some View {
-        if let update = updater.update, let (text, color) = updateNoticeContent {
+        return ToolbarItem {
+            AnyView(
                Button(action: {
                    selectedUpdate = update
                }, label: {
@@ -87,35 +68,41 @@ extension ContentView {
                        .font(.headline)
                        .foregroundColor(.white)
                })
-            .buttonStyle(ToolbarButtonStyle(color: color))
-            .popover(item: $selectedUpdate, attachmentAnchor: attachmentAnchor, arrowEdge: .bottom) { update in
+                .background(color)
+                .cornerRadius(5)
+                .popover(item: $selectedUpdate, attachmentAnchor: .point(.bottom), arrowEdge: .bottom) { update in
                    UpdateDetailView(update: update)
                }
+            )
        }
    }

-    @ViewBuilder
-    var newItemView: some View {
-        if storeList.modifiableStore?.isAvailable ?? false {
+    var newItem: ToolbarItem<Void, AnyView> {
+        guard storeList.modifiableStore?.isAvailable ?? false else {
+            return ToolbarItem { AnyView(EmptyView()) }
+        }
+        return ToolbarItem {
+            AnyView(
                Button(action: {
                    showingCreation = true
                }, label: {
                    Image(systemName: "plus")
                })
-            .sheet(isPresented: $showingCreation) {
+                .popover(isPresented: $showingCreation, attachmentAnchor: .point(.bottom), arrowEdge: .bottom) {
                    if let modifiable = storeList.modifiableStore {
                        CreateSecretView(store: modifiable, showing: $showingCreation)
-                        .onDisappear {
-                            guard let newest = modifiable.secrets.last?.id else { return }
-                            activeSecret = newest
-                        }
-                }
-            }
                    }
                }

-    @ViewBuilder
-    var setupNoticeView: some View {
+            )
+        }
+    }
+
+    var setupNotice: ToolbarItem<Void, AnyView> {
+        return ToolbarItem {
+            AnyView(
+                Group {
+                    if (runningSetup || !hasRunSetup || !agentStatusChecker.running) && !agentStatusChecker.developmentBuild  {
                        Button(action: {
                            runningSetup = true
                        }, label: {
@@ -129,39 +116,23 @@ extension ContentView {
                            .font(.headline)
                            .foregroundColor(.white)
                        })
-        .buttonStyle(ToolbarButtonStyle(color: .orange))
+                        .background(Color.orange)
+                        .cornerRadius(5)
+                    } else {
+                        EmptyView()
                    }
-
-    @ViewBuilder
-    var runningNoticeView: some View {
-        Button(action: {
-            showingAgentInfo = true
-        }, label: {
-            HStack {
-                Text("Agent is Running")
-                    .font(.headline)
-                    .foregroundColor(colorScheme == .light ? Color(white: 0.3) : .white)
-                Circle()
-                    .frame(width: 10, height: 10)
-                    .foregroundColor(Color.green)
                }
-        })
-        .buttonStyle(ToolbarButtonStyle(lightColor: .black.opacity(0.05), darkColor: .white.opacity(0.05)))
-        .popover(isPresented: $showingAgentInfo, attachmentAnchor: attachmentAnchor, arrowEdge: .bottom) {
-            VStack {
-                Text("SecretAgent is Running")
-                    .font(.title)
-                    .padding(5)
-                Text("SecretAgent is a process that runs in the background to sign requests, so you don't need to keep Secretive open all the time.\n\n**You can close Secretive, and everything will still keep working.**")
-                    .frame(width: 300)
-            }
-            .padding()
+            )
        }
    }

-    @ViewBuilder
-    var appPathNoticeView: some View {
-        if !ApplicationDirectoryController().isInApplicationsDirectory {
+    var appPathNotice: ToolbarItem<Void, AnyView> {
+        let controller = ApplicationDirectoryController()
+        guard !controller.isInApplicationsDirectory else {
+            return ToolbarItem { AnyView(EmptyView()) }
+        }
+        return ToolbarItem {
+            AnyView(
                Button(action: {
                    showingAppPathNotice = true
                }, label: {
@@ -171,8 +142,9 @@ extension ContentView {
                    .font(.headline)
                    .foregroundColor(.white)
                })
-            .buttonStyle(ToolbarButtonStyle(color: .orange))
-            .popover(isPresented: $showingAppPathNotice, attachmentAnchor: attachmentAnchor, arrowEdge: .bottom) {
+                .background(Color.orange)
+                .cornerRadius(5)
+                .popover(isPresented: $showingAppPathNotice, attachmentAnchor: .point(.bottom), arrowEdge: .bottom) {
                    VStack {
                        Image(systemName: "exclamationmark.triangle")
                            .resizable()
@@ -183,14 +155,10 @@ extension ContentView {
                    }
                    .padding()
                }
+            )
        }
    }

-    var attachmentAnchor: PopoverAttachmentAnchor {
-        // Ideally .point(.bottom), but broken on Sonoma (FB12726503)
-        .rect(.bounds)
-    }
-
 }

 #if DEBUG
@@ -230,4 +198,3 @@ struct ContentView_Previews: PreviewProvider {
 }

 #endif
-
--- a/Sources/Secretive/Views/CopyableView.swift
+++ b/Sources/Secretive/Views/CopyableView.swift
@@ -8,7 +8,6 @@ struct CopyableView: View {
    var text: String

    @State private var interactionState: InteractionState = .normal
-    @Environment(\.colorScheme) private var colorScheme

    var body: some View {
        VStack(alignment: .leading) {
@@ -78,32 +77,38 @@ struct CopyableView: View {
    }

    var backgroundColor: Color {
+        let color: NSColor
        switch interactionState {
        case .normal:
-            return colorScheme == .dark ? Color(white: 0.2) : Color(white: 0.885)
+            color = .windowBackgroundColor
        case .hovering:
-            return colorScheme == .dark ? Color(white: 0.275) : Color(white: 0.82)
+            color = .unemphasizedSelectedContentBackgroundColor
        case .clicking:
-            return .accentColor
+            color = .selectedContentBackgroundColor
        }
+        return Color(color)
    }

    var primaryTextColor: Color {
+        let color: NSColor
        switch interactionState {
        case .normal, .hovering:
-            return Color(.textColor)
+            color = .textColor
        case .clicking:
-            return .white
+            color = .white
        }
+        return Color(color)
    }

    var secondaryTextColor: Color {
+        let color: NSColor
        switch interactionState {
        case .normal, .hovering:
-            return Color(.secondaryLabelColor)
+            color = .secondaryLabelColor
        case .clicking:
-            return .white
+            color = .white
        }
+        return Color(color)
    }

    func copy() {
@@ -123,9 +128,7 @@ struct CopyableView_Previews: PreviewProvider {
    static var previews: some View {
        Group {
            CopyableView(title: "Title", image: Image(systemName: "figure.wave"), text: "Hello world.")
-                .padding()
            CopyableView(title: "Title", image: Image(systemName: "figure.wave"), text: "Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. ")
-                .padding()
        }
    }
 }
--- a/Sources/Secretive/Views/CreateSecretView.swift
+++ b/Sources/Secretive/Views/CreateSecretView.swift
@@ -12,25 +12,19 @@ struct CreateSecretView<StoreType: SecretStoreModifiable>: View {
    var body: some View {
        VStack {
            HStack {
+                Image(nsImage: NSApplication.shared.applicationIconImage)
+                    .resizable()
+                    .frame(width: 64, height: 64)
+                    .padding()
                VStack {
                    HStack {
-                        Text("Create a New Secret")
-                            .font(.largeTitle)
+                        Text("Create a New Secret").bold()
                        Spacer()
                    }
                    HStack {
                        Text("Name:")
-                        TextField("Shhhhh", text: $name)
-                            .focusable()
+                        TextField("Shhhhh", text: $name).focusable()
                    }
-                    if #available(macOS 12.0, *) {
-                        ThumbnailPickerView(items: [
-                            ThumbnailPickerView.Item(value: true, name: "Require Authentication", description: "You will be required to authenticate using Touch ID, Apple Watch, or password before each use.", thumbnail: AuthenticationView()),
-                            ThumbnailPickerView.Item(value: false, name: "Notify",
-                                                     description: "No authentication is required while your Mac is unlocked, but you will be notified when a secret is used.",
-                                                     thumbnail: NotificationView())
-                        ], selection: $requiresAuthentication)
-                    } else {
                    HStack {
                        VStack(spacing: 20) {
                            Picker("", selection: $requiresAuthentication) {
@@ -38,9 +32,8 @@ struct CreateSecretView<StoreType: SecretStoreModifiable>: View {
                                Text("Authentication not required when Mac is unlocked").tag(false)
                            }
                            .pickerStyle(RadioGroupPickerStyle())
-                                Spacer(minLength: 10)
-                            }
                        }
+                        Spacer()
                    }
                }
            }
@@ -61,208 +54,4 @@ struct CreateSecretView<StoreType: SecretStoreModifiable>: View {
        try! store.create(name: name, requiresAuthentication: requiresAuthentication)
        showing = false
    }
-
 }
-
-struct ThumbnailPickerView<ValueType: Hashable>: View {
-
-    private let items: [Item<ValueType>]
-    @Binding var selection: ValueType
-
-    init(items: [ThumbnailPickerView<ValueType>.Item<ValueType>], selection: Binding<ValueType>) {
-        self.items = items
-        _selection = selection
-    }
-
-    var body: some View {
-        HStack(alignment: .top) {
-            ForEach(items) { item in
-                VStack(alignment: .leading, spacing: 15) {
-                    item.thumbnail
-                        .frame(height: 200)
-                        .overlay(RoundedRectangle(cornerRadius: 10)
-                            .stroke(lineWidth: item.value == selection ? 15 : 0))
-                        .clipShape(RoundedRectangle(cornerRadius: 10, style: .continuous))
-                        .foregroundColor(.accentColor)
-                    VStack(alignment: .leading, spacing: 5) {
-                        Text(item.name)
-                            .bold()
-                        Text(item.description)
-                            .fixedSize(horizontal: false, vertical: true)
-                    }
-                }
-                .frame(width: 250)
-                .onTapGesture {
-                    withAnimation(.spring()) {
-                        selection = item.value
-                    }
-                }
-            }
-            .padding(5)
-        }
-    }
-
-}
-
-extension ThumbnailPickerView {
-
-    struct Item<ValueType: Hashable>: Identifiable {
-        let id = UUID()
-        let value: ValueType
-        let name: String
-        let description: String
-        let thumbnail: AnyView
-
-        init<ViewType: View>(value: ValueType, name: String, description: String, thumbnail: ViewType) {
-            self.value = value
-            self.name = name
-            self.description = description
-            self.thumbnail = AnyView(thumbnail)
-        }
-    }
-
-}
-
-@MainActor class SystemBackground: ObservableObject {
-
-    static let shared = SystemBackground()
-    @Published var image: NSImage?
-
-    private init() {
-        if let mainScreen = NSScreen.main, let imageURL = NSWorkspace.shared.desktopImageURL(for: mainScreen) {
-            image = NSImage(contentsOf: imageURL)
-        } else {
-            image = nil
-        }
-    }
-
-}
-
-@available(macOS 12.0, *)
-struct SystemBackgroundView: View {
-
-    let anchor: UnitPoint
-
-    var body: some View {
-        if let image = SystemBackground.shared.image {
-            Image(nsImage: image)
-                .resizable()
-                .scaleEffect(3, anchor: anchor)
-                .clipped()
-                .allowsHitTesting(false)
-        } else {
-            Rectangle()
-                .foregroundColor(Color(.systemPurple))
-        }
-    }
-}
-
-@available(macOS 12.0, *)
-struct AuthenticationView: View {
-
-    var body: some View {
-        ZStack {
-            SystemBackgroundView(anchor: .center)
-            GeometryReader { geometry in
-                VStack {
-                    Image(systemName: "touchid")
-                        .resizable()
-                        .aspectRatio(contentMode: .fit)
-                        .foregroundColor(Color(.systemRed))
-                    Text("Touch ID Prompt")
-                        .font(.headline)
-                        .foregroundColor(.primary)
-                        .redacted(reason: .placeholder)
-                    VStack {
-                        Text("Touch ID Detail prompt.Detail two.")
-                            .font(.caption2)
-                            .foregroundColor(.primary)
-                        Text("Touch ID Detail prompt.Detail two.")
-                            .font(.caption2)
-                            .foregroundColor(.primary)
-                    }
-                    .redacted(reason: .placeholder)
-                    RoundedRectangle(cornerRadius: 5)
-                        .frame(width: geometry.size.width, height: 20, alignment: .center)
-                        .foregroundColor(.accentColor)
-                    RoundedRectangle(cornerRadius: 5)
-                        .frame(width: geometry.size.width, height: 20, alignment: .center)
-                        .foregroundColor(Color(.unemphasizedSelectedContentBackgroundColor))
-                }
-            }
-            .padding()
-            .frame(width: 150)
-            .background(
-                RoundedRectangle(cornerRadius: 15)
-                    .foregroundStyle(.ultraThickMaterial)
-            )
-            .padding()
-
-        }
-    }
-
-}
-
-@available(macOS 12.0, *)
-struct NotificationView: View {
-
-    var body: some View {
-        ZStack {
-            SystemBackgroundView(anchor: .topTrailing)
-            VStack {
-                Rectangle()
-                    .background(Color.clear)
-                    .foregroundStyle(.thinMaterial)
-                    .frame(height: 35)
-                VStack {
-                    HStack {
-                        Spacer()
-                        HStack {
-                            Image(nsImage: NSApplication.shared.applicationIconImage)
-                                .resizable()
-                                .frame(width: 64, height: 64)
-                                .foregroundColor(.primary)
-                            VStack(alignment: .leading) {
-                                Text("Secretive")
-                                    .font(.title)
-                                    .foregroundColor(.primary)
-                                Text("Secretive wants to sign")
-                                    .font(.body)
-                                    .foregroundColor(.primary)
-                            }
-                        }.padding()
-                            .redacted(reason: .placeholder)
-                            .background(
-                                RoundedRectangle(cornerRadius: 15)
-                                    .foregroundStyle(.ultraThickMaterial)
-                            )
-                    }
-                    Spacer()
-                }
-                .padding()
-            }
-        }
-    }
-
-}
-
-#if DEBUG
-
-struct CreateSecretView_Previews: PreviewProvider {
-
-    static var previews: some View {
-        Group {
-            CreateSecretView(store: Preview.StoreModifiable(), showing: .constant(true))
-            if #available(macOS 12.0, *) {
-                AuthenticationView().environment(\.colorScheme, .dark)
-                AuthenticationView().environment(\.colorScheme, .light)
-                NotificationView().environment(\.colorScheme, .dark)
-                NotificationView().environment(\.colorScheme, .light)
-            } else {
-                // Fallback on earlier versions
-            }
-        }
-    }
-}
-
-#endif
--- a/Sources/Secretive/Views/DeleteSecretView.swift
+++ b/Sources/Secretive/Views/DeleteSecretView.swift
@@ -35,6 +35,7 @@ struct DeleteSecretView<StoreType: SecretStoreModifiable>: View {
                Spacer()
                Button("Delete", action: delete)
                    .disabled(confirm != secret.name)
+                    .keyboardShortcut(.delete)
                Button("Don't Delete") {
                    dismissalBlock(false)
                }
--- a/Sources/Secretive/Views/EmptyStoreView.swift
+++ b/Sources/Secretive/Views/EmptyStoreView.swift
@@ -34,7 +34,7 @@ struct EmptyStoreImmutableView: View {
        VStack {
            Text("No Secrets").bold()
            Text("Use your Smart Card's management tool to create a secret.")
-            Text("Secretive supports EC256, EC384, RSA1024, and RSA2048 keys.")
+            Text("Secretive only supports Elliptic Curve keys.")
        }.frame(maxWidth: .infinity, maxHeight: .infinity)
    }
    
--- a/Sources/Secretive/Views/SecretListItemView.swift
+++ b/Sources/Secretive/Views/SecretListItemView.swift
@@ -29,8 +29,7 @@ struct SecretListItemView: View {
            } else {
                Text(secret.name)
            }
-        }
-        .contextMenu {
+        }.contextMenu {
            if store is AnySecretStoreModifiable {
                Button(action: { isRenaming = true }) {
                    Text("Rename")
--- a/Sources/Secretive/Views/StoreListView.swift
+++ b/Sources/Secretive/Views/StoreListView.swift
@@ -1,10 +1,11 @@
 import SwiftUI
-import Combine
 import SecretKit

 struct StoreListView: View {

-    @Binding var activeSecret: AnySecret.ID?
+    @Binding var showingCreation: Bool
+    
+    @State private var activeSecret: AnySecret.ID?

    @EnvironmentObject private var storeList: SecretStoreList

@@ -13,7 +14,7 @@ struct StoreListView: View {
    }

    private func secretRenamed(secret: AnySecret) {
-        activeSecret = secret.id
+        activeSecret = nextDefaultSecret
    }

    var body: some View {
--- a/Sources/Secretive/Views/ToolbarButtonStyle.swift
+++ b/Sources/Secretive/Views/ToolbarButtonStyle.swift
@@ -1,37 +0,0 @@
-import SwiftUI
-
-struct ToolbarButtonStyle: ButtonStyle {
-
-    private let lightColor: Color
-    private let darkColor: Color
-    @Environment(\.colorScheme) var colorScheme
-    @State var hovering = false
-
-    init(color: Color) {
-        self.lightColor = color
-        self.darkColor = color
-    }
-
-    init(lightColor: Color, darkColor: Color) {
-        self.lightColor = lightColor
-        self.darkColor = darkColor
-    }
-
-    func makeBody(configuration: Configuration) -> some View {
-        configuration.label
-            .padding(EdgeInsets(top: 6, leading: 8, bottom: 6, trailing: 8))
-            .background(colorScheme == .light ? lightColor : darkColor)
-            .foregroundColor(.white)
-            .clipShape(RoundedRectangle(cornerRadius: 5))
-            .overlay(
-                RoundedRectangle(cornerRadius: 5)
-                    .stroke(colorScheme == .light ? .black.opacity(0.15) : .white.opacity(0.15), lineWidth: 1)
-                    .background(hovering ? (colorScheme == .light ? .black.opacity(0.1) : .white.opacity(0.05)) : Color.clear)
-            )
-            .onHover { hovering in
-                withAnimation {
-                    self.hovering = hovering
-                }
-            }
-    }
-}
Author	SHA1	Message	Date
Max Goedjen	61b245c7b0	Automatic for debug builds	2022-11-20 16:40:04 -08:00
Max Goedjen	6a4d96ac02	Test disable entirely for pre-export	2022-11-20 16:30:56 -08:00
Max Goedjen	b2a8928cbb	Fix export path	2022-11-20 16:03:58 -08:00
Max Goedjen	93114a00de	ExportPath	2022-11-20 15:42:02 -08:00
Max Goedjen	5d38da1f4b	Specify team id	2022-11-20 15:37:58 -08:00
Max Goedjen	c917d6067a	Skip install for agent to fix archiving to generic archive	2022-11-20 15:37:53 -08:00
Max Goedjen	7c8d488ef3	Fix export options path	2022-10-27 23:54:11 -07:00
Max Goedjen	d3e3147cc1	generic	2022-10-27 23:50:16 -07:00
Max Goedjen	7715ab4d2b	Tweak	2022-10-27 23:48:26 -07:00
Max Goedjen	b78aa7f0ec	Set destination	2022-10-27 23:40:57 -07:00
Max Goedjen	34703060b8	Merge	2022-10-27 23:34:25 -07:00
Max Goedjen	6dd4088d2f	Secrets duh	2022-10-26 01:46:11 -07:00
Max Goedjen	53087c0439	Secrets duh	2022-10-26 01:43:19 -07:00
Max Goedjen	f32a3a0abd	Just hardcoded	2022-10-26 01:39:00 -07:00
Max Goedjen	8e3d53b5c9	Tests	2022-10-26 01:37:47 -07:00
Max Goedjen	29a9ae9dc9	Simplify paths	2022-10-26 01:30:16 -07:00
Max Goedjen	22832b474f	Reenable env	2022-10-26 01:26:36 -07:00
Max Goedjen	38f48e74b7	Specify path	2022-10-26 00:59:59 -07:00
Max Goedjen	17f5797552	Disale test	2022-10-26 00:57:25 -07:00
Max Goedjen	8255cbb0e9	move up provis and config	2022-10-26 00:57:06 -07:00
Max Goedjen	ab9f8b5600	Switch to latest	2022-10-26 00:56:17 -07:00
Max Goedjen	e97601ad9c	Disable env set	2022-10-26 00:55:46 -07:00
Max Goedjen	200cd6ea9d	Switch to latest	2022-10-26 00:55:01 -07:00
Max Goedjen	2bd8b008ca	Disable env set	2022-10-26 00:54:07 -07:00
Max Goedjen	23611877ca	Back to 11 runner	2022-10-26 00:51:50 -07:00
Max Goedjen	32ebb7f6ec	.	2022-10-26 00:43:11 -07:00
Max Goedjen	0b2b9f8a13	Export options	2022-10-26 00:40:17 -07:00
Max Goedjen	71280fd7a5	Updates	2022-10-26 00:40:09 -07:00
Max Goedjen	6c6364f92c	Turn on automatic everything	2022-10-26 00:21:29 -07:00