The improved Javascript support sounds great, and I'd like to take a closer look at what they're doing with routes. I'm not feeling the idea of checking encrypted secrets into source control, though.

That feels like asking for troubles. I guess it would be okay if everything about the whole encryption system is 100% perfect, but what are the odds of that? If you've ever published a version of the encrypted secrets anywhere public and a bug in the way they use encryption is ever discovered, then all of your secrets are exposed, possibly for an unknown amount of time without you ever knowing. I don't see why you would bother with the risk and trouble when keeping them entirely secret seems much harder to mess up.