> don’t see the use case for first encrypting and then giving the key to the forge

You might only want to keep the files secret from the broader internet, rather than a (trusted) forge, which can make the unencrypted secrets available via an UI for eg. authenticated maintainers.

These cases would benefit from being able to see the secrets transparently in the UI when logged in.

Also, forges having access to e.g. deployment secrets is not that uncommon (e.g. GitHub with deployments via GitHub actions).