I made this change because we had two pointers to cacheword - one in the activity and one in the app.  This was confusing and a potential source of bugs.

The key is already stored in multiple places (CacheWord, sqlcipher, OTR keystore).  I don't think it makes any realistic difference at this point in what data structure it's stored, as long as it's not something that Android persists to disk.  I don't know of any such cases, certainly not a plain Java field in an Activity or App.

If we were passing it to a state-saving icicle (Bundle), I would want to research first if there are any Android OS'es that might persist that to disk.

If we can get a more secure level of storage in the future (TPM?) then we can rethink.