Keychain-backed

Credentials live in the macOS Keychain, never in plaintext, never on our servers.