Not a solution, but they're working on not requiring flakes to copy the whole source directory to the store.

Isn't sops / agenix basically the same thing except instead of you manually putting the secret in foo/secret it's stored encrypted in the Git repo and then it automatically decrypts it at execution time into /var/wherever?