I would guess that secret is just parsed as an authenticator during enrolment (in addition to the certificate) and can be scrubbed after the enrolment takes place?

Nice! Yeah