One way pubkeys get misunderstood is when folks think there should be exactly one key per human being. The long time it takes to generate a traditional RSA key, and the layers of PKI rigmarole around "signing keys" and "certificates", encourages this confusion. I'm wondering if the "This secret-key should be unique per user" phrase here might encourage that sort of confusion.

How about something like: ".. that only you know. Each secret key grants access to specific scopes for a single user account. There may be multiple active keys for each user, and each one is independently revocable at any time. You can authorize (empower) a secret-key by submitting the corresponding public-key and a code to the fxa-oauth-server." ?