code now explicitly sets setSecretKeysExtractable to false