Use Key module for API keys

I think you can technically already use ENV variables or external services to fetch values for the settings.
$settings['media.external_provider.unsplash.access_key'] = getenv('UNSPLASH_ACCESS_KEY');

I'm not opposed to adding support for the key module. Does the key module allows overrides for settings as well, or only for configuration?

Key module is just for storing API keys.

You declare a key as a config entity. It can then be obtained in a variety of ways -- set in config for local development, or from a file or environment variable on prod.