I like the idea. I'm a bit worried though that the vault could stay unlocked in case the script exits early. Ideally I think I would use a separate vault than the one I use for everything else.

Also reminds me of the time when I used Keepass for handling ssh keys; it still can do that I think but I do not do it anymore, maybe I should.