If you have stuff in your tree that's not part of your project's code, you're already dumb.

If it's keys or secrets of any kind, you're even dumber.

If it's in a hidden directory, you are even dumber still.

If you rely on somebody stupid enough to do any of that not to commit it, you have gone beyond the valley of the ultra-dumb. Actually that's true even if you rely on smart people not to do it.

You got your dumb card fully punched when you created `.keys` to begin with.