> Should an error from generateSecret be checked here?

Yes, we do this right here. Sorry about the gap between where the error is declared and this block.