Unless you have a very specific use case, you wouldn't want to store in db or in any message you use in any workflow like this. Usually whatever does the actual work has a way to get the secret.

Secrets are orthogonal to durable execution--what are your concerns about using them together?