I think it is a bit overdue to make sso_secret single use vs “multi use” where it works both for incoming and outgoing SSO.
If we are cleaning this up I think we should probably clean it up all the way. Add a site setting for sso_provider_secrets which contains a list of pairs:
www.somewhere.com|SOME_LONG_SECRET
*.discourse.cloud|SOME_OTHER_LONG_SECRET
Etc… @j.jaffeux new control makes creating settings like this super easy 
but we would need a special mode where it hides the secrets in the UX like we do for other passwordish fields in site settings.
Then we also get extra security here cause even if a key leaks out it can only be used on the “domain” you allowed it so it will simply (post login) redirect to a non-hijacked URL which would be confused about the whole thing cause a NONCE would not check out.
Overall there is not too much work in this change and I totally support it cause it makes SSO provider support way cleaner and will force people using this feature to do a nice audit.