#540 adds a new secrets provider for Vault, plus tests that mock the Vault server.
However, testing against an actual Vault server would make the results more meaningful, and is fairly simple (see secure-systems-lab/securesystemslib#800 for inspiration).