update TODO

diff --git a/TODO b/TODO
index 4631b50a24788c3e7019bc9b0d8b97f3519c9636..5cabd1093ac69eeaccdc9d62c2639131fcc94635 100644 (file)
--- a/TODO
+++ b/TODO
@@ -119,6 +119,10 @@ Deprecations and removals:
 
 Features:
 
+* provide an API to apps to encrypt/decrypt credentials. usecase: allow
+  bluez bluetooth daemon to pass pairings to initrd that way, without shelling
+  out to our tools.
+
 * revisit default PCR bindings in cryptenroll and systemd-creds. Currently they
   use PCR 7 which should contain secureboot state db/dbx. Which sounded like a
   safe bet, given that it should change only on policy changes, and not