A config document is versioned, returned verbatim by GET, rendered in the console, and copied into the audit chain — which can never be edited. Put a PIN in one and it is a PIN forever. So the document holds a reference: secret:hsm-pin (a stored secret sealed so only keysvc can open it), file:/run/secrets/goca-hsm-pin (a mounted file), or env:GOCA_HSM_PIN — and the manual tells you not to use that last one: an environment variable is visible in docker inspect, in /proc/<pid>/environ, in every crash dump.
The file form has two details that bite: the container runs as uid 65532, so a 0400 file owned by root is one goca cannot read; and the default secret directory is on tmpfs, outside any git working tree — the PIN never touches a disk and is never one git add -A from a commit.
secret: is the recommended form: entered once in the console, sealed to keysvc's recipient key, unreadable by the management API, and rotating the PIN becomes a console action rather than a deployment change.
Now I can wire a PIN the audit log will never contain.