The process then still is: check out that Git repository, except there’s another step: copy over your private key so that you can decrypt your secrets.

I store my secrets in a separate private git repo and automatically decrypt them with my hardware key (https://github.com/balsoft/nixos-config/blob/master/modules/secrets.nix) so for me it's literally just plug in my yubikey and nixos-install github:balsoft/nixos-config#hostname