This sectstore + factotum looks pretty interesting. It seems a bit more "complex" though in the sense that it would handle authentication of users on behalf of other programs, like kerberos would do. It happens to provide a file encryption/vault mechanism on top of it.

I'll read it up and try to steal some ideas here and there, most likely for the agent part of my program :)

Thanks for sharing!