Keeping API keys secret (on Github) using a .env file

Have confirmed that Hugo accesses “secret” environment variables from the host at build time (and am aware of the 0.91.0+ security policy config), but it sure would be nice if we could use a gitignored .env file, or something like it, during local development, such as when working with a private API that requires credentials for access. While one certainly can feed environment variables to Hugo in the terminal, that gets unwieldy with more than a small number of these vars. Anybody got a solution that’s anything like the convenience of a local gitignored .env file? (I had no luck with the source .env suggestion mentioned above, including doing it as one command — e.g., source .env && hugo server — to see if that would pass the .env contents to Hugo.)