Keep a file private in a shared repo

Declare the path restricted before you record it. Only listed identities get a key; everyone else carries ciphertext.

printf '.env restricted=alice\n' > .lootattributes
loot describe -m "add sealed .env"
loot push          # the relay stores it but cannot read it