You're basically right. However, it does mean that your secrets aren't stored on disk, so if your backups or SAN are compromised then you're still good. It is

You're basically right. However, it does mean that your secrets aren't stored on disk, so if your backups or SAN are compromised then you're still good. It is also good for syncing secrets across multiple servers, and for keeping the secret up to date, if you have a password that needs to update nightly or monthly or whatever.