file format fix:
 hash whole attibname + value
 don't store hash to verify decrypt. Instead check attribute hashes.
	
set daemon chmod a-r or similar (pctrl)

keyring acls?

keep track of denied_keyrings in ask to avoid asking multiple times

make ask UI nicer

verify acls work
 
missing ops:
 delete keyring
 set keyring info