As another point of reference an HTTP load balancer that mailgun built and uses, called vulcan[1], uses secretbox[2] to encrypt secrets into etcd. There are no good docs on how to use this in practice with vulcanctl so I will need need to ask them to document that :)

[1] https://github.com/mailgun/vulcand

[2] http://godoc.org/code.google.com/p/go.crypto/nacl/secretbox