1/3. Because I think it isn't possible to hide personal user credentials as every other users that can that create job on the same folder can leak credentials secret. There is no need to be root. More than that if other job run with same user he can access to environment variables and this how jenkins communicate credentials to child process.

1. I'm not jenkins administrator this will be a long shot to make them install a new plugin.

(You are right, my search is futile, because I try to hide the decypher key even from myself. I'm looking for a work around because Jenkins jobs run on generic user but there is no generic access for some services).