I know it's not open-source, but this is how I use 1Password with FIFO .envs. I'm unsure if 1P stores its SSH in the enclave, but it works the same way - whenever SSH key is accessed, it prompts for TouchID or password.

Besides the open source, any reason why I should use secretive over 1P?

- someone trying to be better about security no matter how annoyed.