Merge "Secretkeeper: require SECRETKEEPER_ENABLED=true" into main