[Too]

This is exactly how Ansible-vault works. It's many times better than committing them plain, but I'd still vote for some external service providing the secrets runtime only.