That works until you have a multi-person dev team that wants to securely exchange and retrieve secrets without storing them in the repo. For example, S3 creden

That works until you have a multi-person dev team that wants to securely exchange and retrieve secrets without storing them in the repo. For example, S3 credentials, or the API secret to an external service (that may have been rotated since the last time you pulled).