Having them in plaintext always seemed like a bad idea. Forget agents accidentally reading .env; any random package you get from the AUR can trivially read all your keys.
Ideally you'd have read permissions restricted to users/groups that need it, but since most software that needs it is under the user UID, I don't see how this would work.
Ideally you'd have read permissions restricted to users/groups that need it, but since most software that needs it is under the user UID, I don't see how this would work.