update tool for newer sops, drop ssh-to-age, drop ssh host support, more robust refresh-secrets