The idea (and assumption) was that the macOS Keychain app does encrypt my credentials at rest (and allows access only after express user permission).