The CLI test proves export→import logic against a fake gopass; this proves the
real recovery path end-to-end against real gopass in an isolated throwaway store:
seed → seal → destroy every entry → import → assert byte-equal restoration and no
plaintext in the bundle. It is the safety net for no-op-RevokeOld drivers (e.g.
appsecret), where the sealed .age backup is the only rollback — the prerequisite
for the first real rotation.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
leetcrypt
681203cca1