Put them in a external file that you never commit. that's most convenient IMO.
e.g. have a keys.plist and in the appDelegate, just read the keys.plist
Of course another way that is quite error prone is to blank them using * before you commit your source but... nah.. :P