A cluster encrypts Secrets in etcd. What additional protection is still required?

1. Assume application logs cannot disclose the values
2. Disable all authentication checks
3. Control and audit authorized API access to Secrets
4. Publish decryption keys beside every backup