validate secretKey a bit more

[komuw]

• a bit like https://github.com/dropbox/zxcvbn but not to the same length
• https://github.com/wagslane/go-password-validator/blob/main/base.go

Currently we accept a key like 4$aaaaaaaaaaaaa as secure. On https://www.passwordmonster.com/, that key would take 2.4seconds to crack.
We should try and prevent such obvious keys.