In a way RCS is a better architectural fit for this than git, because you can check /etc/shadow in and only one file is used to version it, unlike with git where the whole /etc/.git/ directory has to be locked down to avoid exposing its contents.
Oddly, RCS is about the only VCS not supported by etckeeper yet. (Well, and CVS and svn). It'd be pretty easy to write the 8 or so scripts needed to add support for it to etckeeper.
