We agree that if you store secrets in a repo, any time you change the encryption key, you have to go and purge the underlying secrets. We disagree that this is intuitive or that shops do this reliably.<p>We should be able to agree that not storing secrets in your repo dodges all these problems nicely.