We kinda did this with the snip cli (which is one of our other repos besides the ots cli). It's basically a wrapper around PGP with some additional features like vaults to facilitate sharing PGP encrypted secrets with a team. And... It takes less than 10 minutes to set up :P