The need_secrets() method is called before connect() (where we clear the previous secrets too), so e.g. a password-protected private could be decrypted with the cached password from earlier but if the password was not stored with the connection, it would later fail as no password was requested from the user that could be passed to connect(). References #3428.