canonicalize: support secret keys
handle database error on secret key insert