I propose that Identity and Secret should be made immutable.
The challenge with metadata update and secret get (i.e. to get the encryption details of a secret retrieved via lookup) stems mainly because we are allowing version, metadata, and encryption details mutate the current object. This in turn creates issues around thread safety and complexity around memoization and caching.