# Ignore all age-encrypted secret files
*.age

# But keep the pubkeys directory (for tracked .age pubkey files)
!pubkeys/