the naming throws me off here.  getSecretKeyData and setSecretKey.  So the data is missing.  The comment below says we derive a key. But I don't see it in the code.  
We may want to name these: getEncryptionKey, setEncryptionKey.  Then in the future, if we want a signingKey it would be easy to differentiate.