Hi, I explained why I chose to use a separate secret token in description for this Pull Request, I'll copy and paste it here:

* We use ActiveSupport::MessageEncryptor for our encryption. However, I'm not entirely sure it's entirely secure. Encryption is hard. I noticed that more recent versions of Rails use ActiveSupport::MessageEncryptor in more complicated ways than we do with regard to key generation, we just use a single fixed secret_token instead, like Rails used. I think that's probably good enough for what we're doing though.
* But because it's hard to be sure about this stuff, I did not want to re-use Rails existing secret_token or secret_key_base as our key -- because our use of it might make it easier to attack and discover the key, I didn't want to make the main Rails app secrets vulnerable.
* So we use a separate config.blacklight_export_secret_token. The app generator now generates a config/initializer for this.

If people are confident i'm wrong and this is perfectly safe, it can be changed, but that's why I chose to do it this way.