Merge "Secretkeeper: test sealing policy update" into main