Basic LTI is designed to allow you to configure a tool, but the consumer key and secret should be kept private.
This is because the cartridge should be public. If your key is also public, it defeats the purpose of the key.
https://www.imsglobal.org/specs/ltiv1p0/implementation-guide#toc-5
This should explain why moodle and canvas both ignore it when you include it.
But I'm interested to know if there's somewhere in the ims documentation that says it should be included in the cartridge.