Passphrase-encrypted private key transfer payload (PBKDF2 + AES-GCM JSON blob). Opaque to the server.
endpoint added