[..] and keep the secret key in a “vault” where hopefully it will never be needed.

That's only in bullet point one and where it already falls apart.