Adding Mercurial credentials to Plan 9 secstore for factotum

Even if I authenticate using secstore when logging into my system, factotum doesn’t seem to add any new keys automatically. Maybe I should RTFM or something, but this is how keys are added to secstore manually, almost straight from secstore(1):

; ramfs -p      # private ramfs on /tmp
; cd /tmp
; auth/secstore -g factotum
# enter password
; echo 'key proto=pass service=hg prefix=bitbucket.org user=youruser !password=yourpassword' >> factotum
; echo 'key proto=pass service=hg prefix=bitbucket.org user=youruser !password=yourpassword' >> /mnt/factotum/ctl
; auth/secstore -p factotum

drawterm also asks for a secstore password twice. I don’t know why, exactly. And adding keys manually also asks for the secstore password…