I kind of solved this with salt stack. But i still have like 15 machines where cfg management is nogo. I will use built in pass manager there. But i am open to tips.

I agree that iterm2 password manager is great (i use it too).

I just wanted to mention the sudo-fingerprint feature for the local machine in case someone did not know.