Two things to consider:

1. A way for Vault to provide deployment.keys secrets
2. A way for Vault to provide tokens for nixops-aws and other plugins, instead of reading from the environment.

We should consider if we want to do these at all, and also if we should make its behavior something a plugin could provide.