My solution has always been to treat such keys and secrets as financial instruments, and therefore prone to use only through direct processing - i.e. build/depl

My solution has always been to treat such keys and secrets as financial instruments, and therefore prone to use only through direct processing - i.e. build/deploy environments have to have explicit requirements of allowing the finance guy to come in and type the codes needed to distribute to mass, general public .. but this has to be a managed expectation of dev tooling in general ..