While profiling attic, I found that crc32() calls make up 4.2s of a total of 60s "attic create" runtime.
It seems that attic computes a crc32 over some object metadata (id, length, tag) AND the payload data.
Isn't this redundant considering that the payload data already has a sha256 (unencrypted repo) or even a HMAC (encrypted repo) inside? So, could the payload data be excluded from the crc32 computation without losing anything?