Secure your .envrc with a YubiKey and GPG

I like .envrc because it keeps project configuration close to the project. I do not like .envrc when it becomes a little plaintext bucket of API keys, database URLs, seed phrases, blockchain private keys, and production credentials sitting on disk waiting for the next compromised dependency to read it. This is not primarily about accidentally committing secrets to git. You should ignore .envrc…