passff VS git-remote-gcrypt

Also, there's a firefox extension https://addons.mozilla.org/en-US/firefox/addon/passff/ (on github: https://github.com/passff/passff)

It requires the user to run a daemon that reads ~/.passwordstore passwords and feed it to the extension https://github.com/passff/passff-host - but the design is pretty transparent to inspection if you're inclined to check

The reason I currently use pass is that it has Firefox integration through PassFF: https://github.com/passff/passff

Are you aware of https://spwhitton.name/tech/code/git-remote-gcrypt/?

We use a modified https://github.com/spwhitton/git-remote-gcrypt on some of our git repos and employ the GPG Keychain app (from https://gpgtools.org) to help us manage the associated keys.

I used to rely heavily of Keybase reops, but since the takeover I'm no longer confident in their longevity. An alternative option is to encrypt files yourself and use a mainstream git provider. There are utils like gcrypt specifically for this use case. That way you can be confident in the encryption AND availability.

Yes, git-annex is perfect for this. It can do this with encryption via the rsync special remote. To store the git branches themselves, you can use git-remote-gcrypt. For backups, you can store the files on external hdds (additional to rsync.net) and keep them mostly offline/powered off. git-annex works really well with offline drives. Alternatively you can backup to another cloud provider that is supported as a special-remote.