I understand that it is bad practice to add passwords and secret tokens to source control, with obvious implications arising if you are working on an open-source or related project. Rather, you should store them as environment variables.
However, is it legitimate to add an encrypted private PEM key file to source control for an open source project, and only keep the decryption password as an environment variable? Or should I store the entire contents of the PEM as the environment variable?