When looking at #8035, i noticed borg does an hmac check on the decrypted key.

But to get that, it uses the key derived from the user's passphrase and the encrypted key material from the borg key file.

If the hmac check fails:

• it could be a wrong passphrase fed into the kdf leading to a wrong key decryption key
• it could be wrong encrypted key material from the keyfile (in borg not accepting passphrase (keyfile blake2) #8035 , the user typed that in from a raw printout of the keyfile contents)

So, that is not super helpful to fix whatever needs fixing, passphrase or key.

Maybe we should add another hmac computed over the encrypted key in borg2, so we can detect if there is an error in the keyfile?

Also: if we know the keyfile is correct (after checking that hmac), we could also be sure that the passphrase is wrong if the other hmac doesn't match.