SecretKey tests, allow empty secret keys (ignored)

/cc @armon
Force SecretKey to be nil if empty.

/cc @armon - This makes the API a bit easier, because empty slices are
allowed. This is a lot more in line with how Go treats empty slices as
nil as well (or vice versa)