How to use environment values of type SECRET "On following submissions"?

Your App Specification Reference says the following for the envs/value:

String. The value. If the type is SECRET, the value will be encrypted on first submission. On following submissions, the encrypted value should be used.

Could you please clarify what the last sentence means.

For example, I am declaring an environment variable in my yaml file as follows:

{
  "key": "MAILCHIMP_API_KEY",
  "scope": "RUN_AND_BUILD_TIME",
  "type": "SECRET",
  "value": "MY_UNENCRYPTED_API_KEY_VALUE"
}

Now, based on this:

On following submissions, the encrypted value should be used.

It is not clear if I must re-fetch the yaml file from DigitalOcean in order to get the encrypted values for the value keys? So that on the following submission, my yaml file will have this:

{
  "key": "MAILCHIMP_API_KEY",
  "scope": "RUN_AND_BUILD_TIME",
  "type": "SECRET",
  "value": ";lkajsdf;1lkm23r920s,lc;naksdjv;aldkjvad"
}

Is this correct, or am I misinterpreting the documentation?

Finally, if this is the case, how do I update the value of the value with the new api key when we need to? Do we go to the UI and update it there, and then refetch the yaml file again?

It is a bit confusing, please could you explain the workflow of setting AND updating the values of environment variables of type SECRET

Thanks!