Proton Pass is a great candidate, similar to 1Pass, for a supported provider inside the Kubernetes External Secret Operator. This could be done via calls out to the cli directly if necessary, but direct API calls would likely be more scalable if capable.