Master password or keychain usage for persisted passwords and passphrases in config.json

It would be "nice" to have some way to encrypt all the passphrases and passwords in the apps config.json.
Currently I'm only connecting the app with demo applications and dedicated "toy" ssh keys, but for real-life usage I have to say I'm not so pleased with this. I know, I know, if someone already has access to my home's .config/files everything is screwed up anyway, but at least nobody gets access to my passphrases in plaintext.

I'm also struggeling with this topic in my own electron-apps, and I know this is not an easy thing to get right. Especially when trying to be multi-platform ready. I experimented with atom/node-keytar but the issues around this package made it clear, that at least other node processes are able to access each other.

I'm happy to share my current workflow if you are interested, even if it is far from what I would consider to be satisfactory.

Start with the persisted secrets in config.json and review the issue's notes about Electron and atom/node-keytar. Clarify the supported platforms, threat model, and whether a master password or system keychain is expected; done means an agreed, tested design for protecting stored passwords and passphrases.

Written by the indexing model from the issue text.