In general, I think supporting local workflows is important for providing a good developer experience as well as maintaining a single source of truth (although

In general, I think supporting local workflows is important for providing a good developer experience as well as maintaining a single source of truth (although I know being a purist about this is impossible when what we're doing is managing cloud environments!). So I think that it's an important option. Additionally, when you perform the encryption locally, you don't have to think so much about transmitting the cleartext secret to whatever server/program does the encryption, so that's nice. But cloud-stored secrets are often an exception to single-source-of-truth and the preference for local workflows anyway, and some teams reasonably prefer other workflows. And a network boundary might be a natural place to put some secret sauce for a company like yours, or even just to give users the option of plugging into a centrally managed, shared environment— even if what is running on the remote end is self-hosted and source-available or even open-source.