I like to encrypt secrets with a master secret stored in a TPM. This makes it impossible to accidentally leak the secret.