just wrap the secret key bytes with the temporary kek, as the nonce prefix was already removed before
prevent NPE when using an RSA key in sshSignatureBlobSign (as occured when running tests)