CSRF optional secret in new CSRF options. Confusion

[isimmons]

In the demo from the readme,

// app/utils/csrf.server.ts
import { CSRF } from "remix-utils/csrf/server";
import { createCookie } from "react-router"; // or cloudflare/deno

export const cookie = createCookie("csrf", {
  path: "/",
  httpOnly: true,
  secure: process.env.NODE_ENV === "production",
  sameSite: "lax",
  secrets: ["s3cr3t"],
});

export const csrf = new CSRF({
  cookie,
  // what key in FormData objects will be used for the token, defaults to `csrf`
  formDataKey: "csrf",
  // an optional secret used to sign the token, recommended for extra safety
  secret: "s3cr3t",
});

If I supply a secret in new CSRF as shown, I get a Invalid CSRF error from csrf.validate(). I'm not sure if this 'secret' is in place of 'secrets' in createCookie or in addition to it as an extra layer of security.

If it is an extra security how does one go about validating it? Doesn't csrf.validate need to know what the signing key is?

Thanks