Comment by rgun

* Why a separate service and not a pre-commit hook? * If a third-party has seen the key, hasn't the damage already been done?