I've got a rejected-by-usenix paper somewhere about writing a 9p encryption fs which you could stack on anything that served 9p: exportfs, fossil, tarfs, whatever. It essentially attached to a 9p server, you set the key, it encrypted/decrypted the data as it wrote to its server.
The neat thing about such an encrypting server is you can stack it anywhere you have 9p server, which is quite fun; you can even stack it over another instance of itself. You don't need to be root to use it. You can pick an arbitrary key and don't have to share it with anyone. And so on. I have no idea where it is at this point. maybe you can take cfs and make encrypting? ron
