one key per machine, and one key that stays off every machine
The convenient shape for a secret store is one credential that reads everything, held by every machine. The cost is that any machine becomes a copy of the whole keychain, and one mistaken read becomes indistinguishable from a legitimate…