Congrats on shipping! This is a big deal and an example that I hope the rest of the indie software world follows.
A question now that this is out in the wild: it appears as though the database is encrypted using the sync password, yet that password is stored on the Omni Sync server. As an encryption-implementation-luddite, are there any vectors to attack the encrypted OmniFocus data by way of capturing the login info to the Omni Sync server? Wouldn’t it be safer / better to have a separate encryption key for the the database vs. the password for the sync server?
