the “Pi” wouldn't need to be (publicly) reachable. It would just need to be able to connect to Keybase and other private services. For remote management and talking to private services over internet, i guess SSH, VPN or Zerotier <3 ?

Edit: for secrets in Keybase i think repos are better since its not as easy to mistakenly delete the files ? Plus one has change history. But other people might know better than me.