hm, the first think I do when setting up new tarsnap hosts is create the .key file and back-it-up elsewhere. Since it's a text file '1Passwd' locker is good and if I were more paranoid I'd probably had a printed copy of every key. Just like GPG :-)