You can proxy the UNIX socket to a network server if you want to. You can even use SSL encryption at all times too.
replyOnce it's networked you lose the "whitelist of systemd services" and it's then no different from any networked secret store.
reply