Depends on the circumstances tbh. Things like sops do load the secret unencrypted on the machine (with perms but still unencrypted. For remote VPS encrypted at rest is probably better. K8S has secret management but there unencrypted too.
Another alternative could be using Doppler secrets managment platform, I used it for a while
What’s the current recommend for the original trilogy? Last re-watch I picked up some fanmade recolours of the OG rips, but not sure what’s hotness today. For clarity, I’m looking for watching Alderaan explode like a poorly rendered image of a candle, not any remastered shit.