Questions around key credentials

I have several questions around key credentials.

• in the example here https://github.com/microsoftgraph/msgraph-bicep-types/blob/main/quickstart-templates/application-serviceprincipal-create-client-resource/main.bicep the cert key is passed as secure value. If I understand correctly we are passing public key and later this public key is visible in plain text in the manifest of the app. If that is the case why it is needed to be passed as secret when everything later is visible in plain text?
• What are the available values for usage property? When you enter wrong value the API returns that Verify and Sign are acceptable values but in some of the Learn docs (https://docs.azure.cn/en-us/entra/identity/enterprise-apps/howto-saml-token-encryption?tabs=azure-portal) I have saw that there are other values that are acceptable Encrypt. Where we can get information on all acceptable values for this property. Additionally the doc here https://learn.microsoft.com/en-us/powershell/module/microsoft.entra/new-entraapplicationkeycredential?view=entra-powershell mentions that "for AsymmetricX509Cert the usage must be Verify and for X509CertAndPassword the usage must be Sign". Are there certain values that are acceptable for one type and others for another type.
• What are the available values for type property. The schema mentions Symmetric and AsymmetricX509Cert but doc https://learn.microsoft.com/en-us/powershell/module/microsoft.entra/new-entraapplicationkeycredential?view=entra-powershell mentions also X509CertAndPassword but it does not mention Symmetric. Can we get all acceptable values and their different purposes?
• Is it possible to get the value of Key Vault certificate without using PS script in deployment script. In this example here https://github.com/microsoftgraph/msgraph-bicep-types/blob/main/quickstart-templates/create-client-app-sp-with-kv-cert/main.bicep deployment script is used to get the value needed for key property. I would assume that we do not have the right Bicep functions to be able to get the correct format of the value. In such case shouldn't we have such functions available or may be in addition of the certificate object in the Key Vault we should have a secret object where we have extracted the correct value (with PS for example) from the certificate and we have stored it in it. That way we can use .getSecret() function instead of having to use deployment script? Note that the output of the deployment script is in plain text which connects to the first question.

May be some of my questions are dumb but that is due to my limited knowledge in Entra

Review the linked main.bicep examples and the referenced Microsoft Learn and PowerShell documentation. Compare the documented key, usage, and type values with the schema and deployment-script behavior, including how Key Vault certificate data is handled. Done means providing authoritative answers or updating the relevant documentation to resolve these questions.