embeds secrets in a git repository using deterministic encryption.  store your ssl priv keys in the same repo as your nginx config, without needing to trust your git host.