tldr:

Data path: file → fixed-size chunks → encrypt each block → erasure-code into n shards → upload shards to n servers

Key derivation: nsec → random per-file key → derived per-block subkey