[bpoyner]

Not directly related to this, but you can use systemd-creds to store secrets at rest. It can even work with a tpm2 chip or a key file to encrypt the secrets.

And then use these tips for when you want to interactively reference those stored secrets.