ferngully

Komodo works really well for this and is fairly easy to setup.

I recently installed Pangolin in Hetzner and spun up a statefulset in my k3s cluster for the Newt container. It works beautifully. With it you can proxy Pangolin to the cluster address of your service very easily.

For example: sonarr.media.svc.cluster.local:8989 Format being: deploymentName.namespace.svc.cluster.local

Internally I still use Traefik for my services and just left all the CNAMEs in PiHole pointed to Traefik but if you are external your DNS would look at what's public on my domain and route through Pangolin.

Haha. You aren't wrong. But just rotate the key after. Also, there are plenty of secure delivery methods and encrypted delivery options.

You have a point. But Bitlocker recovery keys are all numeric. Really not all that hard to translate over the phone. Typically a secure email is what we use to deliver since 99% of employees also have email on their mobile devices.