Would be nice if git could store encrypted data and decrypt files on checkout. Repositories could be truly private that way.
1: https://keybase.io/blog/encrypted-git-for-everyone
0: https://blog.zoom.us/wordpress/2020/05/07/zoom-acquires-keyb...
One can just encrypt the .git folder and wrap the git client to handle the encryption/decryption on use. It's always a question where and how well do you keep the keys.
You’re absolutely right about the deltas. Initially I had one secrets file per environment, but as my projects grew I ended up breaking them out to a file per environment-project. Both for storage reasons and because it’s difficult to modify one encrypted file from multiple branches without writing plaintext secrets to disk.