A private tag box for other atproto accounts, hiding in plain sight in
your own public repo. Tags are stored as a
net.bisks.keytags.set record, but the record key isn't the
target's DID — it's
HMAC-SHA256(your secret, their DID). The secret is a
passphrase you type in below; it's never sent anywhere and
never saved, not even to this browser's storage. Without it, every
entry in your repo is an opaque hash next to a list of tags — nobody
(including future-you, if you forget the secret) can tell which is
which.
typed fresh each visit, kept only in this tab's memory — reload the page and it's gone. the same secret + the same DID always hashes to the same entry; a different secret makes the same DID unrecognizable.
everything in your net.bisks.keytags.set collection, exactly as anyone else would see it: a hash and some tags, no DID in sight.