GPG Ansible Password-Client Script

When an ansible vault_password_file is an executable script, then it is run by ansible to lookup the ansible-vault password.
When you encrypt your ansible vault password files with your GPG key and remove the plain-text files, then there is no unencrypted data at rest.