I own the development of a Sidekiq worker that decrypts thousands of gpg encrypted CSVs and loads them into the database.
While not necessary, I'm using a gem to interact with the gpg/GnuPG binary. The gem I'm using is ruby-gpgme. It works great.
My conundrum is in how to best manage the gpg keychain used to store the private key necessary to decrypt the files. Our app is containerized and we don't want to keep our private.key in source control.
What we do now, which I really dislike, is keep the private.key in S3. Each time the job runs, it downloads and imports the key into the keychain. It then proceeds with decrypting the file.
What is the proper way to manage the keys in this case?