1. A method implemented in a non-transitory machine-readable storage medium and processed by one or more processors configured to perform the method, comprising: authenticating a principal, via principal-supplied credentials within a shared-storage environment; identifying the principal for a first access to the shared-storage environment; generating a public key and a private key for the principal; storing the public key and private key in a secret store within the shared-storage environment; receiving a write request from the principal for a file to be stored in the shared-storage environment; providing the public key and private key to the principal; receiving a signature for contents of the file from a file system, signed with the private key; and storing the file and a control data structure for the file in the shared-storage environment, the control data structure including the public key and the signature.