I should have added that this is for enterprise use, and the main use case is providing secrets to services when provisioning new hosts / containers or updating said secrets.

Your comment sounds to me as something that would work well for personal use, as a password manager replacement.