All secret data, including keys from homeserver.yaml, should be stored in secrets folder. In a prod-like deployment it would not be included in git
homeserver.yaml
secrets