An encrypted file stored along with the git repo (without the decryption key) has a different attack surface. My original comment was more targeted towards user

An encrypted file stored along with the git repo (without the decryption key) has a different attack surface. My original comment was more targeted towards users storing their keys in plaintext.