keychain: distinguish between old and new secret format