Several years ago, I worked on a proof of concept for storing secrets in a git repository (making use of smudge and clean config options) where each secret was

Several years ago, I worked on a proof of concept for storing secrets in a git repository (making use of smudge and clean config options) where each secret was encrypted using the public ssh keys (of each server's host key pair) of the servers that would be deployed to. Once the code was pushed to those servers, the clean filter would use the private ssh key of the host key pair to decrypt the secrets.