Ansible has a featur called Vault that encrypts whatever you tell it to with a password. You can then upload that to version control, and when you want to deploy, you just pass the password to Ansible (either via a file or any environment variable, ideally).

I'm using it to migrate us over from keeping our SSL cert in Dropbox and 1Password and it works well.