fix bug with tracking on_decrypt

We needed first off to use 'maybe_secret' since it's not a failure to not have a public key.  Then, we want to
set that we have a secret when it's loaded, properly...