Custodia should have a write-only interface

[npmccallum]

This may already exist in some way. But when using clevis with the tang and http pins, it would be nice to be able to write a secret for later manual, not automated, retrieval.

[simo5]

What you want is metadata that will allow you to write something into Custodia, but then allow retrieval only by a different entity ?

[npmccallum]

Particularly, I'm thinking of the escrow case with clevis. I want to write a secret that can only be retrieved via, say, physical access.

[simo5]

Writing an ACL plugin is easy enough, defininig the rules on who/how/what can access the secrets is another matter.
What do you mean by "physical access" ?

[npmccallum]

I mean a system that is write only as far as network access is concerned. You can push secrets to it, but you can't pull them from it. If you want the secrets back out, you have to have some sort of hardware connect (like a KVM).