You can still expose it as

IOptionsMonitor

I think if you put it in the DB, but then the end users have control over whether they want to put it in KeyVault or elsewhere as well, the build server can set it, so you can update it without having to go into the site to change it.. But not sure how that works, which takes precedence!