Yea, this is a point to think on. The only thing I can think of is that it exists locally with much less security. But that doesn’t make sense, so they must have some way to decrypt it in order to apply the new password to the blob.