Signing secrets and other operator credentials

Not all secrets are user-supplied. Operator secrets like a download-signing secret (Chapter 17) or a session secret must be:

• strong and random (generate with a proper RNG),
• held only in the environment / secrets manager,
• required at startup (fail fast if missing, rather than silently degrading security),
• and rotated with a plan (rotation invalidates anything signed with the old secret, so think through the impact).