Is it possible to add an option, for initremote/enableremote, to encrypt the credentials but not the contents?  Then it would be possible to have an exporttree remote while using embedcreds.  It would also be good if locally stored credentials could be stored in encrypted form, and decrypted for use as needed.  I'm uneasy about keeping credentials accessible without a passphrase.

[[!tag confirmed]]
