Identity, secrets, and signed git: 1Password SSH agent, pass/password-store, and the work/personal identity split.
This setup assumes secrets live outside the git repo: