Plenty of companies choose to accept the risk that an employee might have memorized a secret, but not accept the risk that the employee's secret-encrypting-key might leak at any point for the lifetime of the repository.

Obviously, nothing you do w/r/t secret storage is going to resolve the problem of what's in your employees' heads.