[jacques_chester]

In CF-land the most common pattern I've seen for important keys is a "secrets" repository which is merged with the base config at push time.

[andybak]

With Ansible you have an encrypted vault file that stores your secrets. Similar principle I guess.