remove outdated TODO about hashing the update_secret