[juliend2]

So far, I find Ansible Vault to be good enough for this (when using Ansible at least): https://docs.ansible.com/ansible/latest/vault_guide/index.ht...

You still have to "manage" the vaults' passwords, though.