The secrets file is now parsed line by line, and
each line (excluding CR and/or LF) is used as a secret.
Only the first secret is used for signing, but all
secrets are used for verification.

This is purely cosmetic.

This eliminates a warning about a missing return
statement. The code was correct though, because
hex2num() is guarded by is_hexdigit().