Embeds secrets in a git repository using deterministic encryption.  Store your ssl priv keys in the same repo as your nginx config, without needing to trust your git host.