Your secrets need to be small, easily changed things (keys, passwords). Not large, difficult to change things like protocols. That's the point behind rejectin

Your secrets need to be small, easily changed things (keys, passwords). Not large, difficult to change things like protocols. That's the point behind rejecting 'security by obscurity', so I can't see any dichotomy between the two.