https://5dok.org/document/1y9j23dq-securing-credentials-on-untrusted-clients.html