What are people using to store API tokens (eg. hmac based secrets)? My understanding is that it is symmetric so you need to store it in a recoverable way -- which always means you can leak it. What are better ways?