Some people prefer to keep the keys on specialized servers when a) the need for security is especially acute, and b) the project has the budget. For more day-t

Some people prefer to keep the keys on specialized servers when a) the need for security is especially acute, and b) the project has the budget. For more day-to-day stuff, environment variables on the server are an option. If you want to be able to provision a new server 100% automatically and keep the credentials out of source control, you have a few options. You can add a quick interactive phase to the deploy script, wherein the engineer must enter the key manually. Or the engineer could enter a value which is then passed to a KDF.