Allow `.download` in `Secret/`

[hairez]

Mentioned briefly in #506 (comment).

Main reason is that it would be useful for problems with full feedback.

The current priority is .in.download, .in.statement, .in. The same would apply in Secret/ if this issue gets accepted.

(Technically blocks #505)