Method save_secret_key

atomic-identity/src/store.rs:450–490

Save a secret key (with optional encryption).

(
        &self,
        identity_dir: &Path,
        secret_key: &SecretKey,
        password: Option<&str>,
    )

    /// Save a secret key (with optional encryption).
    fn save_secret_key(
        &self,
        identity_dir: &Path,
        secret_key: &SecretKey,
        password: Option<&str>,
    ) -> Result<(), IdentityError> {
        let secret_path = identity_dir.join(Self::SECRET_KEY_FILE);

        if let Some(_password) = password {
            // TODO: Implement proper password-based encryption
            // For now, we'll store it with a marker that it should be encrypted
            let stored = StoredSecretKey {
                data: data_encoding::BASE64.encode(secret_key.as_bytes()),
                encryption: "none".to_string(), // TODO: Change to "argon2id+chacha20poly1305"
                salt: None,
                nonce: None,
            };
            let content = toml::to_string_pretty(&stored)?;
            fs::write(&secret_path, content)?;
        } else {
            // Store unencrypted (not recommended for production)
            let stored = StoredSecretKey {
                data: data_encoding::BASE64.encode(secret_key.as_bytes()),
                encryption: "none".to_string(),
                salt: None,
                nonce: None,
            };
            let content = toml::to_string_pretty(&stored)?;
            fs::write(&secret_path, content)?;
        }

        // Set restrictive permissions on Unix
        #[cfg(unix)]
        {
            use std::os::unix::fs::PermissionsExt;
            let permissions = fs::Permissions::from_mode(0o600);
            fs::set_permissions(&secret_path, permissions)?;
        }

        Ok(())
    }

    /// Load an identity by ID.
    pub fn load(&self, id: &IdentityId) -> Result<Identity, IdentityError> {