Agent-Proof Secrets Management with TPM and Vaults

@geilt detailed a layered architecture: AWS Secrets Manager with customer KMS keys, IAM roles bound to TPM hardware on Debian, Docker in-memory secret injection so env vars never hit disk, and Restic-encrypted backups to…