According to the LTI spec (http://www.imsglobal.org/specs/ltiv1p2/implementation-guide):

Basic launches can happen from the TC with any combination of TC-wide and link-level credentials including one or the other, both, or neither being present. When both are present the launch uses the TC-wide secret to sign the request.

But in Moodle, if you configure a tool at the Site Level and then when an instructor adds an External Tool and mistakenly enters in something for the key/secret, Moodle uses the link-level credentials, instead of the site-wide one.

This was a problem on our instance, because the password manager that the instructor was using was automatically populating the secret field with the user's Moodle password, because the password manager thought it was a password field.