This is a bit special, as some of the keys do not belong to NixOS hosts, so store those in the module itself, and into host-specific directories for the keys that are NixOS hosts.
Since this configuration was only there to accommodate `aramis`, make it be host-specific instead, and rely on the default value otherwise.
This is the same logic as the common module, but for secrets that don't need to be shared to different hosts.