Nice. Obviously this is a huge issue many are trying to solve. Providing agents with a keychain is one thing, but how does this solve the issue of using these keys in projects? Does the agent decrypt it and set it in a .env? Is the CLI required to be used in the build process?