I think there might be a need for a new function in the getpass module that fetch it from the operating system secure enclave, like KeyChain on OSX.

Currently there is no facility for storing secrets securely, the documentation of secrets says:

> Applications should not store passwords in a recoverable format, whether plain text or encrypted.

but as far as I know there is no facility to save a secret when you actually need to get it back in plaintext.