{ ADD | UPDATE } SECRET 'secret' FOR CLIENT 'client_identifier'
  [ USING TAG 'tag' ]
  IDENTIFIED BY keystore_password
  [ WITH BACKUP [ USING 'backup_identifier' ] ]