s3:secrets: split out a domain_guid_keystr() function