I think this is wrong. The getter should return `Secret`. The reason is that in `GerritServer/index.jelly`,

    value="${it.config.gerritAuthKeyFilePassword}"

will load the password into the form in plain text. `Secret` is designed to be passed back to form reconfiguration in encrypted form.