A clarification about OTR shared secrets - how long need they be secret?
Yes.
OTR uses the socialist millionaires protocol, which is an interactive protocol Alice and Bob use to establish confidence that their secrets match (without either of them disclosing the secret). If the authentication succeeded, both parties store the public key fingerprint of the other and mark it as trusted. The shared secret is not used any further (e.g., to derive keys used in later stages), thus knowledge of it is useless to an attacker after the initial authentication step has finished. (That is, after the authentication was done, there is no difference to manually having compared the fingerprints.)

Of course, if Alice and Bob authenticate again at a later point in time (e.g., because one of them created a new key pair), they must not use the same shared secret if it is not secret any more. (This should be obvious.)