Comment by harvey7

lock your env vars in hardware. even the whole server and code is compromised, the secrets are still safe.

so you dont need env2 to decrypt env1.

https://seal.zone/ does this