To keep the API key a secret, we're encrypting the environment file in the repository with GnuPG. The decrypted copy only lives in the work tree and is never committed. Changes have to be re-encrypted and committed.
