If all you have in your repo is a rar-ed file, you lose pretty much all the benefits of a sophisticated version control system, such as branching / merging, diffs, efficient differential storage, etc. If you want to keep going down that road, then you don't really need a version control system - a directory of RAR files will do exactly the same for you (minus the IDE integration, but you can easily script your way out of that one).
If you do want to leverage the benefits of source control, here's what you can do:
- Set up a dedicated machine to work on, with full-disk crypto. The machine can be a VM if you don't have a spare one lying around, as long as everything is encrypted. Make sure nobody has access to that machine except yourself. Pick strong passwords.
- On that machine, set up a git repo and your development environment.
- Lock down network access: your development machine should have a very restrictive set of firewall rules (and a good firewall). Most importantly, lock down all incoming traffic except what you absolutely need: there is no reason to allow incoming HTTP traffic, for example. If it's a VM running on your local workstation, you don't need any network access at all, except for downloading software updates.
- Copy the RAR file to the development machine, unpack it, and put the unpacked files in your git repo.
- Whenever you need to ship a RAR, export the git repo's HEAD version and RAR it up with a suitable password, then copy it off the development machine.
This method actually has a few advantages over your current approach: the unpacked files are never written to disk unencrypted (because the entire development machine's disk is encrypted), and since the development machine serves only this one purpose, you can apply far more restrictive security measures - for example, you don't need to run a web browser (you can do that on your 'regular' machine), you don't need to read any e-mails, you don't need things like flash, Java, etc. And if at some point you stop working on that project, you can just wipe the crypto key, and everything you ever knew about the project will be gone. Also, the encryption provided by TrueCrypt and similar full-disk crypto solutions is far better than anything RAR has to offer.
Either way, you need to decide on a threat model to defend against, and see which strategy works best.