We consider the distribution of secret keys, both in a bipartite and a multipartite (conference) setting, via a quantum network and establish a framework to obtain bounds on the achievable rates. We show that any multipartite private state--the output of a protocol distilling secret key among the trusted parties--has to be genuinely multipartite entangled. In order to describe general network settings, we introduce a multiplex quantum channel, which links an arbitrary number of parties, where each party can take the role of sender only, receiver only, or both sender and receiver. We define asymptotic and non-asymptotic LOCC-assisted secret-key-agreement (SKA) capacities for multiplex quantum channels and provide strong and weak converse bounds. The structure of the protocols we consider, manifested by an adaptive strategy of secret key and entanglement [Greenberger-Horne-Zeilinger (GHZ state)] distillation over an arbitrary multiplex quantum channel, is generic. As a result, our approach also allows us to study the performance of quantum key repeaters and measurement-device-independent quantum key distribution (MDI-QKD) setups. For teleportation-covariant multiplex quantum channels, we get upper bounds on the SKA capacities in terms of the entanglement measures of their Choi states. We also obtain bounds on the rates at which secret key and GHZ states can be distilled from a finite number of copies of an arbitrary multipartite quantum state. We are able to determine the capacities for MDI-QKD setups and rates of GHZ-state distillation for some cases of interest.