Please see the discussion here. https://forum.cardano.org/t/cardano-cli-signing-a-transaction-without-directly-accessing-the-skey-file-in-plain-text/103742/11
cardano-cli should be able to read signing keys from a named pipe to maintain a high level of security while handling keys, a bug report was submitted but no further interactions. https://github.com/input-output-hk/cardano-node/issues/4101
Thoughts? Alternative approaches? Maybe we can flag someone from IOG who can help clarify if this has been discussed and is a design choice or is it really a "bug".