If 1Password hadn't jumped the subscription model shark, I'd be all over that. Any chance you'd entertain supporting bitwarden?
replyVarlock has bw plugin too - and similarly you can either wire up individual items or pull a whole env style blob from a single item if you prefer.
replyFYI - You can pull a whole .env style blob from a single item using varlock. Never written to disk and supports caching behind Secure Enclave.
reply