If ncryptsec isn't stored on the client, how can it be retieved and decrypted without asking for password? Either it can't be retrieved, or it can using stored hash but can't be decrypted, or it can be retrieved and decrypted but then stored hash can be stolen and used to retrieve and decrypt, which is equivalent to just storing the nsec. Am I missing something?