Confidential Dedup via Threshold OPRF — and Auth Lockout
Threshold-OPRF lets E2EE cas blobs dedup without revealing content hashes — plus adaptive failed-auth backoff and lockout.
E2ee
Client-Held E2EE: Envelope Encryption Real
Envelope encryption with a client-held key: the server stores ciphertext and can’t read it — across S3 and native transports.