`sops` combined with `age` is great! Benefit is that it doesn't tie you into 1Password's ecosystem

That looks interesting, but unless I'm missing it, it still leaves you with things like ~/.aws/credentials in plaintext on disk, doesn't it?