In continuing to evaluate the best approach to storing security credentials, I have found the following Trailhead module for Secure Secret Storage: https://trailhead.salesforce.com/content/learn/modules/secure-secret-storage?trail_id=security_developer

In my use case, protected custom metadata types are the best fit as I would like to store multiple environment endpoints for the same service with a public custom setting to control which endpoint it points to (UAT, SIT, PROD). However I have a concern regarding how quickly the secret is updated.

Consider a situation where there is a breach in security for a service provider that SF connects to and the secret credentials need to be updated. Salesforce documentation states: "updated secrets in metadata types aren’t available right away".

What does "right away" mean? Is it scheduled to whenever the org has availability to process the metadata change similar to a future method or is there a standard propagation time for changes to salesforce metadata? Maybe something similar to a changeset deployment?