I think this is correct, but let's discuss this one a bit more. When a secret is pushed in with a payload, you set its 'payload_content_type' but that only applies to the mode used to push the secret in.  When it is retrieved, all you have stored is the 'payload_content_encoding', not suitable for the GET 'Accept' header. So we'll probably need to map an encoding to a suitable content type, and display that with the secret metadata and use with GET calls.