I got tired of the modern, cluttered web. So I found a solution in the command-line by using two CLI apps together.
Keys are read from BuildConfig fields populated via local.properties (git-ignored) or CI environment variables, never embedded in source files or strings.xml. Encrypted local storage.