Covert and secret quantum key distribution aims at generating information-theoretically secret bits between distant legitimate parties in a manner that remains provably undetectable by an adversary. We propose a framework in which to precisely define and analyze such an operation, and we show that covert and secret key expansion is possible. For fixed and known classical-quantum channels, we develop and analyze protocols based on forward and reverse reconciliation. When the adversary applies the same quantum channel independently on each transmitted quantum state, akin to a collective attack in the quantum key distribution literature, we propose a protocol that achieves covert and secret key expansion under mild restrictions. The crux of our approach is the use of information reconciliation and privacy amplification techniques that are able to process the sparse signals required for covert operation and whose Shannon entropy scales as the square root of their length. % diffuse information content quantified through Shannon entropy induced by the sparse signaling required for covert operation. In particular, our results show that the coordination required between legitimate parties to achieve covert communication can be achieved with a negligible number of secret key bits.