pub fn deserialize_secret(stored: &str) -> SshCliResult<String>Expand description
Deserializes from TOML: decrypts sshcli-enc: blobs; otherwise returns as-is.
Uses SecretContext::unbound, so it accepts v1 blobs and v2 blobs that
were themselves sealed unbound, but rejects a v2 blob bound to a concrete
host/field. Call sites that know the owner must use
deserialize_secret_in_context to get the relocation check.