I've used `sops` "manually" before and I'm interested. What is your workflow? I'm assuming you set certain directories to have access to the sops key you're storing somewhere else to be able to encrypt/decrypt files?