"Do not keep secret keys on the instance." I'm curious how people deal with this--what approaches do you use?
Before that at Netflix we developed a service that would hand out temporary keys to the requestor when they presented a proper certificate.
At reddit we put the secret keys on the instance, which was bad. :)