This looks very interesting. Any comments on production-worthiness? This isn't your target scenario, but could it evolve into a component for using IAM-style credential management for companies running their own servers instead of using AWS? I'm always interested in new techniques for removing secret keys from server configs.