client-side tags for arbitrary secrets

[indomitableSwan]

We should consider including a human-readable tag that is created during the generation of an arbitrary secret. This can be useful for versioning and usability.

Additionally, the tag may be useful, in combination with the server-generated key identifier, as a client-side identifier. That is, the tag could incorporate/bind to context for the arbitrary secret, including the key identifier.

This tag would not have to be revealed to the server, and could instead be treated as part of the arbitrary secret itself in terms of storage on the server (and lost device recovery).