I am working on a secrets manager for the paranoid, and part of the idea is to do this, yes. However, most of the idea is to get secrets off of your disks and

I am working on a secrets manager for the paranoid, and part of the idea is to do this, yes. However, most of the idea is to get secrets off of your disks and out of your git repos. That's mainly what Hashicorp Vault and AWS Secrets Manager do for you. They turn authenticated roles into the ability to access your secrets so they don't go in a plaintext file.