&gt; When someone is out - just delete his public key, reencrypt the files, and he won’t be able to decrypt secrets anymore.<p>But they still can encrypt old versions stored in git, no? Do you change all secrets when somebody leaves the team&#x2F;company? I guess that&#x27;d be best practice, but I have no idea how often that&#x27;s done out there.