One of the causes of the local_settings.py anti-pattern is that putting SECRET_KEY, AWS
keys, etc.. values into settings files has problem:

Secrets often should be just that: secret! Keeping them in version control means
that everyone with repository access has access to them.

My question is how to keep all keys as secret?
Ideally, local_settings.py should not be checked in for production/deployed server. You can keep backup copy somewhere else, but not in source control.
local_settings.py can be checked in with development configuration just for convenience, so that each developer need to change it.
Does that solve your problem?
Keep Secret Keys Out