More details about how macOS 26.4 changed the login keychain

I wrote macOS Tahoe silently sabotaged the login keychain on September 10 and macOS 26.4 silently enabled login keychain data protection on September 21. These blog posts necessarily included some conjecture, because Apple itself was silent on the issue. It turns out that nobody outside of Apple fully understood the technical details. On September 24, six months after the release of macOS 26.4, Apple finally provided some documentation by adding a new section Backing up a file-based keychain to an old developer technical note about the macOS keychain API. As far as I’m aware, Apple still has not provided any end-user, non-developer documentation on support.apple.com about the macOS 26.4 change to the login keychain. I’ll quote the new developer technical note section in full: Historically each file-based keychain was a standalone file. You could, for example, copy a keychain file from one Mac to another and still use it, as long as you knew the keychain password. In macOS 26.4 and…