I think sops-nix actually hits the sweet spot here. You use a standard tool for secret management (sops) to write encrypted files that can be published publicly, but can only be decrypted on a host using a specific non-published secret (host ssh key most commonly, but something via vault, 1password, etc could also be used). A systemd service does the decryption during boot and writes to somewhere in /run so they're not ever persisted to disk.