security What Key Rotation Actually Stops (and What It Doesn't) Rotating an age key re-encrypts secrets/db.enc.env to a new recipient list going forward. It does nothing to the plaintext an old key already read, and nothing to the ciphertext still sitting in earlier git commits.
sops Keeping Secrets in a Private Git Repo Without Actually Leaking Them secrets/db.enc.env is committed to a private GitHub repo, key names visible, values encrypted — and two independent age keys, one per machine, mean neither one alone has to be shared with the other.
