Currently we need to leverage the terminus secrets plugin to manage secrets without commitng to version control. This generates a secrets.json file and we must write glue code to map that to environment variables. It would be nice if we could set these as environment variables and not have to deal with the main file or glue code.
We also use Terminus Secrets to manage secrets across many sites using a custom upstream. Secrets set at the organization level is a feature we have been wanting for a long time.