This is great advise, and depending on your organization and stack, best when coupled with Vault. Vault stores all secrets needed by running services (ACL toke

This is great advise, and depending on your organization and stack, best when coupled with Vault. Vault stores all secrets needed by running services (ACL tokens, access keys, credentials for databases, PKI for certificates, what have you). For the rest (Vault unseal keys/cert keys/operator token, other operator secrets), secure those with the GPG keys mentioned above and store them in some way that suits you (GNU Pass/git-secret/there are several alternatives). Where you draw the line between what's stored in Vault and not will depend on your org and its needs.