Why? My main Nix configuration is stored inside of a flake, so it gets copied to the store every time I rebuild. This avoids that security hole by storing my secrets in a seperate repository.