I wrote some of my thoughts on the topic, and the primary motivation behind SOPS [1] (which uses PGP and KMS): https://jve.linuxwall.info/blog/index.php?post/20

I wrote some of my thoughts on the topic, and the primary motivation behind SOPS [1] (which uses PGP and KMS): https://jve.linuxwall.info/blog/index.php?post/2015/10/01/Introducing-Sops%3A-an-editor-of-encrypted-file-that-uses-AWS-KMS-and-PGP https://jve.linuxwall.info/blog/index.php?post/2015/10/01/In... The initial trust problem boils down to trusting the API that controls the provisioning of your infrastructure. Failing that, you have to ask a human to manually authorize new nodes to retrieve secrets (that's how puppet approves new agent certs). [1] https://github.com/mozilla/sops https://github.com/mozilla/sops