OpenTofu: state encryption and leaving Terraform without drama
OpenTofu encrypts state and plan client-side, before the backend ever sees them — a feature Terraform still doesn't have. We cover migration, key providers (PBKDF2, AWS/GCP KMS, OpenBao), and why backend encryption isn't the same thing.
