This obfuscates the error message too much.

Useful for subdomains which are handled by the same
mail server.

The secrets file is now parsed line by line, and
each line (excluding CR and/or LF) is used as a secret.
Only the first secret is used for signing, but all
secrets are used for verification.

This is purely cosmetic.

This eliminates a warning about a missing return
statement. The code was correct though, because
hex2num() is guarded by is_hexdigit().