Forgets the stored passphrase. Existing backups keep the passphrase they were written with.
Whether a passphrase can be stored on this system, and whether one already is.
Stores a passphrase, replacing any existing one, once the user has confirmed it.
The backup passphrase, kept encrypted by the OS keyring in a file outside the database (the database is what ends up inside the backup, so a passphrase stored there would ride along inside the very container it protects).
Deliberately write-only: there is no way to read the passphrase back, so a frontend script cannot exfiltrate it. Only the main process ever sees the plaintext again, when it writes a backup.
Both changes are also gated on a native OS confirmation, which a script can request but cannot answer. Without that, a script could quietly swap in a passphrase of its own and every later backup would be encrypted to it.