Zerobase – encrypted zero-knowledge KV+SQL store where the server can't read your data

I built Zerobase, an encrypted database in pure Rust where the server is
architecturally blind to all stored data.

The core idea: with PrivateClient, keys are BLAKE3-hashed and values are
AES-256-GCM encrypted before any network call. The server stores ciphertext
it cannot decrypt even with root access.

What's in the box:

• LSM-tree engine: WAL (AES-256-GCM + Ed25519-signed + BLAKE3-chained)
• Ed25519 challenge-response auth + capability tokens with scoped revocation
• Raft consensus: election, log replication, log compaction, cluster mode
• SQL layer (SELECT/JOIN/WHERE/ORDER BY)
• TLS 1.3 via rustls — zero OpenSSL anywhere
• Hardware key derivation: machine-id + DMI + MAC → 32-byte master key
• #![forbid(unsafe_code)] across all 10 crates

Status: Alpha. Crypto design and storage engine are solid, 94+ tests
passing. Raft is implemented but InstallSnapshot isn't done yet.

Looking for feedback on the security model, the Raft implementation, and
anyone who wants to try breaking it.

GitHub: https://github.com/ODev-M/ZeroBase