I think if you substitute all your questions with env vars, all the same issues present themselves. You have to roll secrets whenever someone with access no lon

I think if you substitute all your questions with env vars, all the same issues present themselves. You have to roll secrets whenever someone with access no longer has access, and the env vars can be stale just the same as the encrypted file.