We have a fair amount of secret-management recipes in this stack. We should put it in a helper library, not a recipe included all over the place.