Eclipse Enclave does exactly that: There is an outbound firewall and secret injections, so that the agent never sees a real key. And it's fully open source: https://github.com/eclipse-enclave/enclave

Looking at the Readme it seems like it only supports docker. Which is a dealbreaker for some