I dunno, it seems mostly simple to me.

You have a .sops.yaml with some Age public keys, and then you run “sops secrets.yml” to create an encrypted file.