I'm curious how delete and nuke permissions can be granted independently. Is there a separate HMAC key that just allows nukes ( http://www.tarsnap.com/crypto.html states that there are only three HMAC keys, though).
Also, how is this feature expected to be useful? Is there some interesting security property you get by having a key with delete but not nuke, or vice versa?
