Covert and secret quantum key distribution aims at generating information-theoretically secret bits between distant legitimate parties in a manner that remains provably undetectable by an adversary. We propose a framework in which to precisely define and analyze such an operation, and we show that covert and secret key expansion is possible. For fixed and known classical-quantum wiretap channels, we develop and analyze protocols based on forward and reverse reconciliation. The crux of our approach is the use of information reconciliation and privacy amplification techniques that are able to process the sparse signals required for covert operation and the Shannon entropy of which scales as the square root of their length. In particular, our results show that the coordination required between legitimate parties to achieve covert communication can be achieved with a negligible number of secret key bits.