> Everything should be encrypted both in transit and at rest. When your secret is encrypted, it is not available to the attacker and you can cut off access and

> Everything should be encrypted both in transit and at rest. When your secret is encrypted, it is not available to the attacker and you can cut off access and rotate the plaintext secret to remedy the situation. Not sure how valid this point is. If the attacker has access to a production server, he had also access to all needed production keys. Encrypted or not.