May I suggest agenix? It dovetails into my deploy-rs flake setup very nicely and I can track the encrypted secrets in the flake repo. I keep the "master" key e

May I suggest agenix? It dovetails into my deploy-rs flake setup very nicely and I can track the encrypted secrets in the flake repo. I keep the "master" key encrypted in pass passing it in a zsh's "=" subshell to agenix.