Envelope encryption with server-held private keys turns local backup into remote asset extraction.