systemd v256 will have support for credentials that are encrypted at rest, locked against the system's TPM, and can be used by a per-user service (prior versions only supported it for system services).

https://mastodon.social/@pid_eins/112336318532407967

This is a much more secure way to store credentials than git-annex's current .git/annex/creds/ which is only protected by unix permissions, and so it would make sense for git-annex to use it. It would need a way for git-annex to start a systemd user service when it needs access to a credential.

Note that GNOME/XDG desktop secret managers have work underway to support this systemd feature, so git-annex might be able to alternatively use them to access creds rather than using a systemd unit directly. --Joey