Encrypted secrets in Git with a tool written in Rust under a fully permissive license is the right way to do it. Encrypted copies of secrets in environment variables is okay too, as long as they are encrypted.

The somewhat widely known Mozilla SOPS is a tool in the same broad category.

I hadn't seen securestore-rs before. Thank you for sharing this.