the workflow is as follows:
* age is used to manually encrypt e.g the sops keys file so it can
securely be stored in git
* homeage decrypts the file and symlinks it where sops expects it to
be present. decrypted, which it will be, but it will in fact be
residing in $XDG_RUNTIME_DIR (which *should* be tmpfs) and only be
symlinked to $HOME/...
* sops can from then on be used to manage arbitrary secrets as usual
