How to share project secrets?

[amberin]

Let's discuss our available options for sharing project secrets. At this moment, I am aware of the following important secrets, which, at this moment, are only fully available to myself:

• the JKS keystore used to sign prerelease and release APKs. (Also stored as a repo secret.)
• the password to above-mentioned JKS. (Also stored as a repo secret.)
• login password to the Google account [email protected], created recently by me. A Dropbox account is linked to this account, and this Dropbox account now owns the Dropbox "app" named "Orgzly Revived".
• the Dropbox app key. This is visible when logged in to the Dropbox account, so only the Gmail account password is needed. (Also stored as a repo secret.)

The first two are by far the most critical ones.

I'm thinking this thread should not focus on who should have access to the secrets, but assume that there is a certain amount of trusted project members, who should have access to these secrets in case the Github repo secrets are lost.