The real difference over a file is that you some intelligence(the manager) running that can offer all kinds of additional security functionality. A typical dep

The real difference over a file is that you some intelligence(the manager) running that can offer all kinds of additional security functionality. A typical deployment might involve placing the manager on a secure host that has access to generate and rotate keys, for example. The manager can then configured to re-generate keys and vend them on-demand to instances that need require them. You can configure these keys with very limited access, and also make them expiring. The manager then becomes effectively a keystore that can never export master keys, but only vends out some limited-scope keys to other instances. Other instances would have to authenticate using some pre-configured host keys or even be authenticated directly though the cloud provider. If your instances are compromised, the worst someone can do is to get access to a limited-scope key that will expire. Hopefully you have other measures in place that would prevent and detect someone from just sitting on an instance and sucking up all your data and exporting them.