1. A method comprising: receiving, on a first computing device, a registration password, the registration password provided to a plurality of client instances for registering the client instances to participate in a secure storage facility on a shared data store, the secure storage facility implemented using a key encryption scheme; generating or receiving, on the first computing device, a first encryption key to be used in the key encryption scheme; calculating a key encryption key to be used to encrypt the first encryption key, the key encryption key calculated based at least in part on the registration password; encrypting the first encryption key with the key encryption key; creating a key element comprising the encrypted first encryption key; storing the key element on the shared data store; storing the key encryption key on a local persistent data store of the computing device; after storing the first encryption key on the shared data store, receiving, on a second computing device, the registration password; retrieving, on the second computing device, the key element that contains the first encryption key from the shared data store; retrieving, on the second computing device, a salt from an unencrypted segment of the key element; using, on the second computing device, the registration password and the salt to calculate the key encryption key; using, on the second computing device, a checksum retrieved from an unencrypted segment of the key element to verify the correctness of the received registration password; and storing, on the second computing device, the key encryption key in a local, persistent data store associated with the second computing device.