The terms "primary key" and "secondary key" are used incorrectly here.

A custom de-deduplication rule means you're using a compound de-duplication key (a key composed of multiple underlying fields). But it's neither a primary key, secondary key, nor unique key (there's absolutely no requirement in the database for the compound key to be unique, thus you should not use those terms as they will cause -- and have caused -- confusion when talking about Marketo with in-house IT or really any technical folks).

The compound key is correctly described as: a means of locating a lead when a pre-check of the database is performed, which only occurs via some input methods. Those inputs do include form posts from previously anonymous Munchkin sessions; they don't include all API connections, nor previously associated Munchkin sessions, nor flow steps, nor CRM integrations.