[bootloop]

I use a similar flow with the technical team to avoid unencrypted credentials in SCM. The vault (or other secrets) are encrypted with a common passphrase and then only this passphrase is whats encrypted with GPG for multiple recipients.