Regarding the sticky note problem, this can be mitigated with separate vault credentials for production. That way you can limit prod secrets to a much smaller group, and if you wanted to rotate when someone leaves, you'd have to do it much less often.