Comment by stryan

Fnox (by jdx of mise) supports fetching secrets and caching the results either in local age encrypted files or in a background daemon (in memory only) to minimize repeated gets. The daemon is per terminal instance too I believe so you fetching a secret once doesn't store it for the whole session.

It's not a perfect fix but it keeps secrets out of env with (so far for me) minimal inconvenience.