The offline tool that opens a backup. Generates recovery keys and decrypts
artifacts, depending only on manager-protocol and opening no sockets.

This is the tool a recovery key comes from, so nothing in Manager's backup
flow is usable until it can be installed.