I agree, sops / ejson / gitcrypt or something else that encrypts a file in vcs, then use your cloud or shared secret vault to disperse the decryption key.