also check out https://dmno.dev/docs/plugins/encrypted-vault/

And it's super easy to do. I used GPG with a passphrase before I adopted sops and PGP keypairs.

Just make sure that you gitignore the plain-text dotenv. That's the hard part (on a team)