The core problem to secrets management is service identity. Managing encrypted data is not hard, it's actually really easy. It's the identity that is hard.
You're just trading out all of my secrets for a new secret. This works for password managers because I remember one password, but doesn't work for applications because you still end up with this env key baked in to source code...
You're right that the ENVKEY still needs to be protected. There is no getting around the need store and protect some sort of key.
You definitely should not be keeping it in source code--it should be set in a gitignored .env file (in development) or as a server environment variable (in staging/CI/production).
It's true that you are essentially trading out multiple secrets for a single one, but there are a number of major benefits to doing this, both for security and ops.
1 - It's much easier/quicker to cut off access.
2 - It's much easier/quicker to rotate secrets when they need to change.
3 - It makes it trivial for developers and sys admins to get access to the latest secrets so they don't resort to sharing over email, Slack, etc. in order to get their work done.
4 - You don't have to worry about keeping secrets in sync when they're stored outside of source control. In my experience, this is a frequent cause of bugs, and it slows down development.
I would also have to disagree somewhat that managing encrypted data isn't hard. Just encrypting data and sending around public keys isn't particularly hard, but unless you are implementing your own web of trust logic to verify that public keys are authentic, you are leaving yourself open to all kinds of man-in-the-middle attacks. EnvKey does the hard work on this.
I think, just like vault, this is missing the point wrt secrets management for services. Sorry to be the negative nancy but this is something I've spent a lot of time on and feel pretty strongly about.
In short, while EnvKey doesn't solve every conceivable issue with managing secrets securely, and still requires some common sense, I think it does offer a drastically better default workflow for companies that are currently sharing secrets on email or slack, keeping them in git, etc.
As a happy Vault user I'm curious about your thoughts here.