I think being able to have the encryption key in somewhere other than settings.yaml is a good idea (as I don't think this file should contain sensitive info), much like `config/initializers/local_secret_token*`, but this could be read out and made accessible somewhere other than SETTINGS for use.