Masked keys, a create flow that reveals the secret exactly once, and a revoke that confirms before it fires.