Edit: I missed part of the question. The repository below only references installing yay. Could you have the become_password as a vault secret in ansible and respond to the password prompt with expect?
I literally stumbled upon this a few hours ago, maybe it will help.
The best way I find to think about it is a padlocked box.
The public key is a box with an open padlock on it. I can give it to anyone. If someone puts a message inside the box they can lock the padlock, but they don't have the key to open it again.
I keep the key private. If someone sends me a locked box that has my padlock on it, only I have the key to open it and read the message.
Wayland does only do the most basic stuff and leaves everything else to the compositor (aka Gnome or KDE). That means every compositor will implement their own hacky version of the missing functionality and it takes ages until that gets unified again, so that apps can actually use that functionality.
Would this functionality be mostly the same? Could they get together to make a shared libcompositor that implements the bulk of the functionality? Or is it so tied to specifics of the desktop environment that there's little commonality. In which case, Wayland not doing it would be the right call.
There's a few. LessPass is one that has been going a few years.