Shouldn't you put the secrets in the shared_db *after* you run `_store_secrets` so the MAC gets generated?