We're working to move away from managing sensitive credentials in this way. Mostly by removing humans from the process and handling.

If this is the primary use-case, I would emulate something like bitlocker and enterprisey features for $