private String lookupSecret(String secretName) throws IOException {
    String secretLocation = SECRETS_DIR + secretName + SECRET_EXTENSION;
    monitor.debug(()->format("Getting app secret for %s (blob %s)", secretName, secretLocation));
    byte[] encryptedSecret = getRawBytes(secretLocation);
    checkState(encryptedSecret != null, "Couldn't look up: " + secretName);
    String secret = new String(appSecretDecrypter.decryptAppSecret(encryptedSecret)).trim();
    checkState(!Strings.isNullOrEmpty(secret), "Couldn't decrypt: " + secretName);
    return secret;
  }
Store keys and secrets in a cache so we can reduce load on cloud storage / KMS when reading
keys and reading/decrypting secrets several times on startup.

<p>Set the cache to reload keys/secrets periodically so that in the event of a key/secret being
compromised, we can update them without restarting our servers.
extensions/cloud/portability-cloud-google/src/main/java/org/datatransferproject/cloud/google/GoogleAppCredentialStore.java