Investigate tooling for secrets

[bdashrad]

look at something like git-crypt for managing secrets in the repo, instead of out of band.