introduce keychain item and encryption key repositories
handle invalid keychain item UUIDs gracefully