Yes, I'm using Dagger and it has great secret support, obfuscating them even if the agent, for example, cats the contents of a key file, it will never be able to read or print the secret value itself

tl;Dr there are a lot of ways to keep secret contents away from your agent, some without actually having to keep them "physically" separate