A file the mesh can deliver and cannot read

Everything else in a declaration is visible to whatever carried it. The
message is signed so it cannot be forged, and signing does not make it
unreadable — a password in `content` is a password the broker sees, which
is the transitive trust this design refuses everywhere else.

So a node generates a third key at enrolment and reports the public half,
exactly as it does for its identity and its overlay key. A file may
arrive `sealed` instead of `content`; the host opens it with that key and
writes the result. The control plane can then store a credential it
cannot use, and the broker relays a blob it cannot read.

A third key rather than reusing one of the two. The identity key signs
and is Ed25519; the overlay key is WireGuard's and is tied to being on
the private network, which a machine may not be. A key used for two
purposes is one rotation away from breaking the other.

Details that are not incidental:

- sealed and content together is refused, so "was this the secret or the
  placeholder" is answerable by looking
- a sealed file defaults to 0600 rather than 0644, because the
  consequence differs; an explicit mode still wins
- a node with no sealing key refuses the file rather than skipping it. A
  machine that quietly omits the one resource carrying a credential looks
  configured and cannot connect
- what is recorded is a digest of what was written, so drift on a
  credential is still detected without the node keeping the value, and
  the report that goes back over the broker carries neither

The key is made at enrolment rather than on first use. One made later is
one the mesh was never told about, so nothing could ever be sealed to it,
and the node would look fine and receive nothing.

This is why sealing was borrowed from another mesh's mistakes rather than
its design: there, credentials sit encrypted in the control plane's
database — which guards the database file and nothing else, since the
same value is also in each node's environment file in plain text and
inside every connection string composed from it. Its own tooling has to
search by value rather than by name to find the copies, and says the ones
inside composed URLs are usually the only copies in use.

cmd/mesh-host/main.go

@@ -331,11 +331,12 @@ func runApply(ctx context.Context, opts options, d *declaration.Declaration, sou
 		return err
 	}
 
-	report, updated, applyErr := apply.Apply(ctx, sys, d, known, store.OriginCarried, apply.ExecRunner, func(line string) {
-		if !opts.json {
-			fmt.Println(line)
-		}
-	})
+	report, updated, applyErr := apply.Apply(ctx, sys, d, known, store.OriginCarried,
+		apply.ExecRunner, func(line string) {
+			if !opts.json {
+				fmt.Println(line)
+			}
+		}, sealOpener(opts.state))
 
 	// Saved whichever way it went. Recording only on success would lose the footprint of a
 	// failed apply, and that footprint is on the machine either way.
@@ -449,6 +450,15 @@ func enrol(ctx context.Context, opts options) error {
 	}
 	fmt.Printf("generated this node's overlay key:  %s\n", mine.Overlay.Public)
 
+	// And the key secrets are sealed to. Here, with the others, because the mesh cannot seal
+	// anything to a key it has not been told about — a key made later would leave a node that
+	// looks enrolled and can receive no credential.
+	sealing, err := identity.GenerateSealingKey()
+	if err != nil {
+		return err
+	}
+	fmt.Printf("generated this node's sealing key:  %s\n", sealing.Public)
+
 	// What this machine can be asked to do, gathered before joining rather than after. The
 	// control plane cannot decide what a node should run without it, so it travels with the
 	// request instead of being asked for in a second round trip.
@@ -459,7 +469,7 @@ func enrol(ctx context.Context, opts options) error {
 	}
 
 	reply, err := link.Enrol(ctx, token.Broker, token.Fingerprint, *name, token.Secret,
-		mine.Public, mine.Overlay.Public, reported, opts.timeout)
+		mine.Public, mine.Overlay.Public, sealing.Public, reported, opts.timeout)
 	if err != nil {
 		return err
 	}
@@ -504,6 +514,10 @@ func enrol(ctx context.Context, opts options) error {
 		[]byte(mine.Overlay.Private+"\n"), 0o600); err != nil {
 		return fmt.Errorf("cannot write this node's overlay key: %w", err)
 	}
+	if err := os.WriteFile(identity.SealingKeyPath(opts.state),
+		[]byte(sealing.Private+"\n"), 0o600); err != nil {
+		return fmt.Errorf("cannot write this node's sealing key: %w", err)
+	}
 
 	fmt.Printf("\nenrolled as %s\n", reply.Node)
 	fmt.Printf("  identity   %s\n", identityPath)
@@ -649,7 +663,7 @@ func applyAndKeep(ctx context.Context, opts options, raw []byte, signed *store.D
 	// Declared, not carried. A declaration from the mesh removes only what the mesh previously
 	// declared — never what this machine raised for itself from its bundle (04-ISSUES/010).
 	outcome, updated, applyErr := apply.Apply(ctx, built, declared, known, store.OriginDeclared,
-		apply.ExecRunner, nil)
+		apply.ExecRunner, nil, sealOpener(opts.state))
 
 	// Saved whichever way it went. Recording only on success would lose the footprint of a
 	// failed apply, and that footprint is on the machine either way.
@@ -709,3 +723,17 @@ func waitForEnrolment(ctx context.Context, opts options) (identity.Identity, err
 		}
 	}
 }
+
+// sealOpener is how a sealed file is opened.
+//
+// Looked up per file rather than held, because most declarations contain no sealed file at all
+// and a node with no key must fail on the one that needs it rather than on every apply.
+func sealOpener(statePath string) apply.Unseal {
+	return func(sealed string) ([]byte, error) {
+		key, err := identity.LoadSealingKey(identity.SealingKeyPath(statePath))
+		if err != nil {
+			return nil, err
+		}
+		return key.Unseal(sealed)
+	}
+}