Deep down in the cwtch stack there is a 3rd party dependency that handles encrypted sqlite databases.

That dep has been slowly rotting, which is a bit of concern given it's age, purpose, it's interaction with C code.

I've recently been afforded some time to dig into it / update its deps etc.

Today I realized we can replace 10k lines of C crypto code there with a 250 line wrapper into standard/safe go libs.

And everything works! (which, bonus byproduct: validates some of the older code too)