I primarily use Alacritty. I spend quite a lot of time running things that produce ludicrous amounts of output (eg. compiling Android from source). Out of 10 or so terminal emulators I've tested earlier this year, it was the only one that didn't use 100% CPU displaying all that output, staying in the low single digits.
I'd prefer to use Wezterm because I like its lua configuration system and the builtin pane splitting, but with my workload, I still run into issues where its CPU usage shoots to 100% and becomes non-responsive for a while. (That said, it's already a lot better than before. I try to report any issues I can reliably reproduce and Wez has been wonderful about fixing them.)
If you want to get fancy: systemd credentials. It can store the secrets encrypted on disk and seal the encryption key with the TPM chip. The encrypted secret is decrypted (non-interactively) and made available only to a specific systemd service. The process itself does not special systemd integration--it just sees a plain text file containing the secret, backed by a
tmpfsthat's not visible to other processes.Depending on which TPM PCRs you bind to, you can choose how secure you want it to be. A reasonable/usable configuration would be something like binding to PCRs 7 and 14. With that setup, the TPM will not unseal the key if the system is booted into any other OS (i.e. anything signed with a different UEFI Secure Boot key). But if you really want to lock things down, you can bind to additional PCRs and make it so changing any hardware, boot order, BIOS setting, etc. will prevent the TPM from unsealing the key.