also resources would be able to declare some of their output as secrets by default and document it in APIdocs by using dedicated type for it, like https://www.pulumi.com/docs/reference/pkg/nodejs/pulumi/gcp/serviceaccount/#Key-privateKey