the “Pi” wouldn't need to be (publicly) reachable. It would just need to be able to connect to Keybase and other private services. For remote management and talking to private services over internet, i guess SSH, VPN or Zerotier <3 ?
Edit: for secrets in Keybase i think repos are better since its not as easy to mistakenly delete the files ? Plus one has change history. But other people might know better than me.
to determine when to deploy i mention its possible to listen to team chat messages for commits, so event based. There might be more efficient solutions, think i came across somewhere that its possible to listen to other types of events. need to dig deeper
Edit: for secrets in Keybase i think repos are better since its not as easy to mistakenly delete the files ? Plus one has change history. But other people might know better than me.