https://github.com/docker/docker/issues/13490
It's not 'secure by default' if secrets are flying around through the system with no formal way to prevent it.
If you're playing to the 'secure by default' crowd, they aren't going to just trust that you're on the case if you don't communicate. Platitudes are something people watch out for when security is on the line, and they'll chose another solution if they think you're full of shit.
You have to show, at all times and all things, how you're thinking about the problem. 15 months of dead air is a lot to atone for.