I thought running a HashiCorp Vault cluster just to securely pass API keys to production was a bit much. So I built Clef: a tokenless, zero-server secrets manager using Git, SOPS, and KMS envelope encryption. Better security, smaller footprint.