Customizable dest path and basic secrets (sops)

Can specify where to put the rendered templates, relative to config roots
Can specify to encrypt a subset of the files using sops (requires sops installed locally), but not a great solution yet