Reveal a secret value once

Step two of two. Atomically consumes the grant and returns exactly one value; the grant is burned whether or not the reveal succeeds. The calling key and the bound revision are re-read and compared at consume time, so a different key, a rotation, a reinstall supersession or a termination invalidates an outstanding grant. A REVOKED key is refused earlier still, by the credential check every request passes through. Every reveal is audited with the key's id. The response is Cache-Control no-store, private.