The first secret is used to encrypt, the rest are for decryption; if the first doesn't work, the rest are tried in order. The makes it possible to rotate keys.
All repo tests build their tables by applying all the migrations. This way we know our migrations are functional.