Metadata encrypted with message before sending to server

Possible downside: cache is now completely cleartext. Maybe not so bad?

We could add an option, --purge-cache