We use vault, but sometimes I just `openssl` gpg encrypt the secrets with the keys of all the members of my team and commit the .gpg to git. We all use yubikeys and use them to SSH.

Not ideal, but it works... At least until one of us resign (but turnover is quite low here, so crossed fingers).