We use a secret manager on our cloud platform for key storage, manually rotate keys (for now), and store encrypted passwords on a separate db.