Investigate secret store error paths

[guybedford]

There may be a missing error path here when a secret store hostcall like plaintext returns an optional none.