Borg: (re-)encrypt existing repo

[ThomasWaldmann]

There are some valid usecases where users want to:

• encrypt a unencrypted repo (AND the unencrypted repo is assumed to be confidential / not exposed yet to prying eyes)
• re-encrypt / re-authenticate an existing encrypted repo with new key material

This needs a careful design to not leave the repo in a non-working state in case the operation gets interrupted while the repo is only partially processed. Also it would be nice to have some checkpointing, so an interruption does not mean having to start from the beginning.

[ss23]

There is also a use case for un-encrypting an encrypted repository, though I'd rate it lower priority.

[fcartegnie]

Since that won't be achieved without changing the whole repo, doesn't this feature belong to a more generic streamed export/import ?
That would just be an internal stream format, and filters could be implemented to pass zfs send/receive, tar stdin/stdout, dumpe2fs/restorefs.