KeyVault as variable

I want to put my template into Azure Marketplace. I need to provide a static password, but the customer (who starts the template deployment) must not see this password, so I provide it via KeyVault.
It works when adding KeyVault object as a paramter, but when the customer starts Deployment via Portal GUI - what should he enter in the text field?
It would be much better if I can provide KeyVault object via variables - will this be supported soon?

Start by reviewing how Azure Marketplace template deployments expose parameters in the Portal GUI, then compare that with the issue's requested Key Vault object through variables. Done would require a clearly supported way to supply the Key Vault reference without exposing the static password, along with documented deployment behavior.

Written by the indexing model from the issue text.