n0n
Vault gives time limited Tokens with Network Boundary. Instead of Keeper, i would just use age:
# write
echo "my secret" | age -r <recipient-pubkey> > secret.age
# read
age -d -i key.txt secret.age
Branch targets are encrypted — decryption only works if the chain state is correct, which requires every prior control flow decision to have been correct, all the way back to the run key.
I'm using single round AES instructions which require AES-NI Wrong key, modified binary, or even a debugger breakpoint causes execution to instantly collapse into garbage. Its written in Rust and currently passes 261/276 Wasm spec tests (remaining 15 are cross-module imports).
Currently supports SIMD, atomics, exception handling, memory64, tail calls, and WASI with sandboxed file I/O and TCP sockets.
Im tinkering around with porting it to a sel4 backend in adition to the posix backend.
https://www.schneier.com/blog/archives/2016/03/data_is_a_tox...
Alpine with lbu[0] seems like a perfect fit and looks IMHO less experimental. Also you can provide backups straight via iPXE[1].
Nonetheless, kudos for the slim ubuntu image :)