The environment variable RESTIC_PASSWORD_COMMAND works but has not been documented yet. e.g. it could contain a command that would fetch the password from a local user keyring enhances: https://github.com/restic/restic/pull/2094