>  You thought you made the Secret "single-use", but what you really did was to just encourage someone to keep the unsealed String around and reuse that, because you gave them a Secret type and they needed a String type

In a reasonable development process, one that doesn't abet dangerous mistake-makers, forcing clients to invoke a special method of the Secret class (single use or not) to "unseal" it gives a valuable auditing tool for free: every dangerous situation can be found by a simple search for usages of this method, while a marked string value that contains a secret is undistinguishable from a normal string and can be misused.