The bottom turtle is a hardware key

Encrypting secrets into git is the easy half — the hard half is what opens the first door, and that chain has to bottom out in something you can't copy.