When a second machine checks for a shared secret, now the exists() call returns negative and only when updating the secrets for that machine, the machine is added to the sops receivers.
Also throw proper errors when the user switches backends without cleaning the files first.