Prevent private key from being saved in JSON

[antogit-sys]

Hi,
would it be possible to customize your tool so that the private key is not stored in the JSON file?

[derektamsen]

Hi @antogit-sys, I do not believe there is any critical reason for the tool to cache the escrowed password to disk. I think it was added as a safety feature in case we needed to re-upload them in the future. The re-upload functionality does not exist at this point. The logic was that if someone already had the disk unlocked and could login to the system it didn't really matter if they could read the machine's unique escrow key because they already had local access. However, I do not see a reason it is required nor do we have plans to need to re-read it from disk at this point.

I think if you wanted to disable the functionality you could add a cli flag and optionally disable the call that persists the key to local disk. It would still upload the key to the escrow server. Then, when running luks2crypt you could use some flag, --no-persist-key-local for example, and have it skip writing the key to local disk. I would be happy to review a PR if you wanted to attempt to add the feature.