Use a gpg smartcard (yubikey or similar). This is how I store Ansible Vault secrets. You’re absolutely right about the deltas. Initially I had one secrets file

Use a gpg smartcard (yubikey or similar). This is how I store Ansible Vault secrets. You’re absolutely right about the deltas. Initially I had one secrets file per environment, but as my projects grew I ended up breaking them out to a file per environment-project. Both for storage reasons and because it’s difficult to modify one encrypted file from multiple branches without writing plaintext secrets to disk.