The trust issue is real and that question is always valid. Like "hey, maybe there is a guy at hotmail that reads my emails and will do something bad with their

The trust issue is real and that question is always valid. Like "hey, maybe there is a guy at hotmail that reads my emails and will do something bad with their content". But when you put your secrets in a single database for convenience, if there is a problem, you know where it comes from. And your secrets manager would suffer the consequences. That said, a optionnal simple zero-knowledge approach is very possible. You would have an encryption key that you enter locally and in your CI / server and you would never send your actual secrets, but an encrypted version of them. Is it something that would help you trust the service ?