We agree that if you store secrets in a repo, any time you change the encryption key, you have to go and purge the underlying secrets. We disagree that this is intuitive or that shops do this reliably.
We should be able to agree that not storing secrets in your repo dodges all these problems nicely.
We should be able to agree that not storing secrets in your repo dodges all these problems nicely.