[coenhyde]

You can put your keys in source control if you are encrypting them with another key which is not in source control. Otherwise you're doing it wrong.

[Too]

This is exactly how Ansible-vault works. It's many times better than committing them plain, but I'd still vote for some external service providing the secrets runtime only.