-blob=$KEYS/recov/$recov/current/$label.recov
-if [ ! -f $blob ]; then
- echo >&2 "$quis: no recovery blob for secret \`$label'"
- exit 1
-fi
-mem=$(userv root claim-mem-dir </dev/null)
-reveal=$mem/keys.reveal/$recov.current/secret
-if [ ! -f $reveal ]; then
- echo >&2 "$quis: current $recov key not revealed"
- exit 1
-fi
-tmp=$(mktmp); cleanup rmtmp
-ec_decrypt $reveal -i$blob