`sops exec-env` I have an alias set for when I'm working with opentofu: `alias tfenter='sops exec-env secrets.yaml "/bin/bash"'` I encrypt with openbao's tra

`sops exec-env` I have an alias set for when I'm working with opentofu: `alias tfenter='sops exec-env secrets.yaml "/bin/bash"'` I encrypt with openbao's transit engine and backup age key kept in a password manager, so no secrets live on disk.