My preference is to self-host Hashicorp Vault on a non-routed network. Suppose if I get real paranoid could implement WireGuard too.

https://yakihonne.com/article/naddr1qvzqqqr4gupzqv9enyt2zcqyug7f8nhjp5r0skt5ayzrl6ytcxmug5q03v7vdcl7qq25vwf3ggek7n60w3n4w434896ny5r92vckv3pte8s