Hi, I’ve been taking a look a look on this issue.
As @seb128 said, portals seems to be a great alternative in this scenario. They would allow snaps to store the information encrypted with a key provided by gnome-keyring, while considering the confidentiality of other secrets stored in the system. In fact, access to the secret-portal seems to be already granted by the “desktop” interface, which is already auto-connected.
However, as portals rely on the gnome-keyring version installed in the host systems, it only works properly when this version supports the secret-portal backend. I’ve been able to run a proof-of-concept in Ubuntu 22.04 and newer releases. So an option would be to use the secret-portal when present (it can be detected in the same way than libsecret does), and otherwise fallback to the current behavior.