While I think we should keep this functionality in NixOps core it could be reimplemented as an internal plugin. This would not only help keeping things nicely separated but would allow us to figure out what hooks we need for other plugins.