be consistent in requiring a secure connection (when available) for key ops (bb#407)