Looks interesting.  But I think I must be missing something.<p>Are the symmetric keys that are used to encrypt the private keys derived from a password, or not?<p>&gt; This protocol overcomes this weakness by wrapping all key packets, encrypted with a key derived from a second high-entropy alphanumeric passphrase.<p>&gt;<p>&gt; The passphrase SHOULD be a random high-entropy uppercase alphanumeric string of 24 characters, generated from a cryptographically secure pseudo-random number generator (CSPRNG).<p>So do you seed the CSPRNG starting from something derived from a password?  And if not, then how do you decrypt your private keys when you want to use them on a new device?