diff -r fdfbe5d7b677 -r c36e549a7f12 config.py
--- a/config.py	Sat Jan 20 23:50:36 2018 +0000
+++ b/config.py	Sun Jan 21 00:58:06 2018 +0000
@@ -15,16 +15,19 @@
 #
 
 defaults={
-   # Default: backup every 6 hours (21600 seconds)
-   'backup_interval': 21600,
-   # Default: retry every 15 minutes if unable to connect / unfinished backup
-   'retry_interval': 900,
-   # borg
-   'borg': {
-       'executable': 'borg',
-       'common_parameters': [],
-       'create_parameters': [],
-       'prune_parameters': [],
+    # borg
+    # Default: backup every 6 hours (21600 seconds)
+    'backup_interval': 21600,
+    # Default: retry every 15 minutes if unable to connect / unfinished backup
+    'retry_interval': 900,
+    # Extract passphrases at startup or on demand?
+    '__extract_passphrases_at_startup': True,
+    # Borg settings
+    'borg': {
+        'executable': 'borg',
+        'common_parameters': [],
+        'create_parameters': [],
+        'prune_parameters': [],
     }
 }
 
@@ -125,20 +128,22 @@
 # Verify basic settings
 #
 
-if 'borg' not in settings:
-    settings['borg']=defaults['borg']
-else:
-    def check_and_set(cfg, field, loc, defa, fn):
-        cfg[field]=fn(cfg, field, field, loc, defa[field])
-        return cfg
+def check_and_set(cfg, field, loc, defa, fn):
+    cfg[field]=fn(cfg, field, field, loc, defa[field])
+
+def check_parameters(cmd):
+    check_and_set(settings['borg'], cmd+'_parameters',
+                  'borg', defaults['borg'],
+                   check_list_of_dicts)
 
-    def check_parameters(cmd):
-        settings['borg']=check_and_set(settings['borg'], cmd+'_parameters',
-                                       'borg', defaults['borg'],
-                                       check_list_of_dicts)
-
-    settings['borg']=check_and_set(settings['borg'], 'executable', 'borg',
-                                   defaults['borg'], check_string)
+check_and_set(settings, 'backup_interval', 'top-level', defaults, check_nonneg_int)
+check_and_set(settings, 'retry_interval', 'top-level', defaults, check_nonneg_int)
+check_and_set(settings, '__extract_passphrases_at_startup', 'top-level', defaults, check_nonneg_int)
+check_and_set(settings, 'borg', 'top-level', defaults, check_dict)
+# Check parameters within 'borg'
+if True:
+    check_and_set(settings['borg'], 'executable', 'borg',
+                  defaults['borg'], check_string)
 
     check_parameters('common')
     check_parameters('create')