check / check (push) Successful in 11m7s
Restore and deep verify now report "cannot decrypt this snapshot: the private key in VAULTIK_AGE_SECRET_KEY is not one of the keys the backup was encrypted to", naming the key source like the invalid-key error. The doubled "creating decryption reader" prefix and the outer "downloading snapshot database" / "failed to decrypt database" prefixes are gone for this case. A blob the key cannot decrypt, such as one stored before the key was added as a recipient, now reports "cannot decrypt this blob: the private key in VAULTIK_AGE_SECRET_KEY is not one of the keys the blob was encrypted to" after the file and blob it belongs to. Model: opus-5-5