> Which keys count as secret is decided by built-in heuristics on the key name

Maybe you could automatically redact high-entropy strings? It might be more reliable than looking at key names.