Secure deletion is generally built indirectly:
- Encrypt the data with a randomly-generated key.
- Store the key in a single place (perhaps itself encrypted with a key derived from a password).
Then, instead of deleting all the bits of the data, the secure deletion process only needs to ensure that it wipes the key.
This allows the key file to be stored on a different media type than the file data, for example the file data can be on a hard disk or SSD and the key data on a smaller but more secure device such as a removable flash drive (which you always carry with you) or a smartcard (which makes extracting the key difficult). To destroy the key, it is enough to wipe or destroy the small, cheap media containing the key.
This setup is easy to arrange at the whole-filesystem level (for example, LUKS under Linux can work with a keyfile stored on a different media or with a password that is stored on an OpenPGP smartcard), but I don't know of any ready-made solution at a per-file level.
It's not very convenient, but you can build something with encfs under Linux. Encfs encrypts a directory tree with a key that is stored in a file (
.encfs6.xml at the root of the encrypted tree). You can move this file to another storage device (which can be read-only) and create a symbolic link. Then you can effectively wipe the encrypted tree by destroying or wiping the device containing the key. The key file only needs to be written once, so as long as you use a filesystem that doesn't reallocate blocks (e.g. ext2), overwriting the file in place is enough to wipe the prior content (at least at the logical level; flash drives do their own block reallocation so it may still be possible to recover the data by taking the drive apart to bypass the controller).