- generate keys in ./sops instead of ./sops/vars for now - don't initialize all flakes with sops keys, only generate when needed - use the new 'clan vars keygen' in tests