Technically sops-nix doesn't require sops files to be added to the repo. It's just what most people choose because it makes deployment convenient - if you have your deployment tool uploading sops files that would be a way around. I have also heard people using private flake inputs. You may find https://github.com/numtide/systemd-vaultd useful if you go the vault route