Roman,

> I was thinking rather in the direction of statically linking Firebird
> database engine (not server) in something bigger, and that bigger
> provides its own means for remote protocol (if any), encrypted storage,
> key management, tampering detection, etc.

I like it that way. Which means having hooks such that an application linking the embedded version (would it need to be statically linked in for that matter, not sure) can instruct the fb core to callback the app host for pio (to make it short and simple).

In other words: do not design for security plugins to fb, but design fb to be a db plugin to an application shell implementing the security. Is that precisely your mind?

Sounds really interesting to me to reverse the point of view in such way.

--
Olivier