My $.02 here.
The DBA should track the application passwords. The developers shouldn't ever have the production passwords, or the QA passwords for that matter. The DBA should hold all these keys, and give them to the sysadmin who does the deployments as needed.
Personally I've got a little web app that I built a few companies ago which I've found handy. It allows you to put the usernames and passwords into the database, which stores the passwords in a secure encrypted form. All access to the app is logged for SOX auditing.
Access to the accounts is granted via the app so that as the DBA I can create an account and give the developers read access to the account within the app so that they can see the dev password. Same goes for the sysadmin for the QA and Production passwords.