SCTL is not End2End encryption, instead SCTL is more of an envelope, in which you store secrets until they are needed, and those secrets should only remain available in plain text while the operation that needs them is active.
sctl should check its own release feed for updates. This should be a non-blocking function after the operation(s) have run so as to not impede the users function with the tool.
get the Github Release Feed
Check configured version id against github release
notify of new version + display changelog if available.
That sounds similar-ish to what you describe, could be useful. That said, it does carry a lot of dependencies with it, so maybe a lighter-weight solution would be better.
sctl should check its own release feed for updates. This should be a non-blocking function after the operation(s) have run so as to not impede the users function with the tool.