The MAC gets generated whenever you use `export_recovery_document()` (see https://github.com/leapcode/soledad/pull/95/files#diff-be7eb97b6ad942b061949ea93de1744eR1129) and both `_store_secrets()` and `_put_secrets_in_shared_db()` use `export_recovery_document()` (see https://github.com/leapcode/soledad/pull/95/files#diff-be7eb97b6ad942b061949ea93de1744eR623 and https://github.com/leapcode/soledad/pull/95/files#diff-be7eb97b6ad942b061949ea93de1744eR732, respectivelly).

About the check of the MAC, i have put it outside `import_recovery_document()` exactly because I wanted to decouple recovery document import/export from secrets storage in local disk or in remote database. I could have added a conditional and a call to `_store_secrets()` inside `import_recovery_document()`, but then I wouldn't have those three functionalities as separated as I think they should be.

Also, in the futures, we will not need to check whether the MAC is available, because the idea is that every stored secrets (in local disk or server) will have a MAC.