How do I handle third-party API credentials in settings? I am building a module that will need to integrate credentials for the 3rd party service in Drupal 8. The module's admin panel should remember the credentials and use them to interact with the service, but still hold them secure. Storing the credentials un-encrypted or exporting them in config with drush cex can pose a threat. How are such cases to be handled in Drupal 8? What is a good way to handle secure 3rd party credentials with Drupal 8?

Details: A module integrating with the 3rd party online service. This service provides credentials, that the user inserts in the module's admin form, and then can use the services. It won't do to hard code the credentials in PHP, and saving them as config in Drupal 8 will result in them being exported with drush cex. So, there is a need to store secure data in the settings, and keeping it from export when config is exported.
The key module provides a framework for abstracting key storage from modules. The module provides 2 key providers (plugins) out of the box: config and file. It is possible to implement a key provider plugin for some arbitrary storage such as what the encrypt module provides.

Note that a web site's actual security risk for using a particular key provider depends more on security procedures and infrastructure.