You can encrypt them using something like https://github.com/FiloSottile/age and then just store them in git. When you need to access them, just run "age -d .."

If you're paranoid you can use GPG + a smart card like a yubikey, but its all about convenience trade off..