Comment by mattmein

Check out agenix-rekey[https://github.com/oddlama/agenix-rekey], it has the ability to set up secret generators.