> secrets stored in SOPS files, in turn encrypted by keys held in any of the above SOPS does already work this way, right? You don't have to use local GPG keys

> secrets stored in SOPS files, in turn encrypted by keys held in any of the above SOPS does already work this way, right? You don't have to use local GPG keys or whatever with SOPS, you can use keys from AWS KMS or stored in HashiCorp Vault or whatever