rook, for a secret service. It uses whichever standard KeePass DB you give it as the backing store, and functions as a server so you can unlock once and then make requests with client calls.
It supports the Linux kernel keyring to restrict access to the server process to only client calls in the same user session, which helps protect against compromised root and user accounts (although, if root is compromised you have bigger problems).
It's big raison d'etre is that it doesn't use a bespoke backing store that nothing else understands, as pass, secret-service, and ksectetserviced all do. No custom DB, just KeePass, meaning syncing and using your secrets across devices is no harder than SyncThing.