add passphrase-protected / digest-verified metakey