Because the dst file mtime may already be newer (if the dev-django
container is not reinitialised). We actually need to copy the secrets
when either the source or destination container is reinitialised
(hence the pattern match on the $TODO)