Seems like the only way is to have a base list, or at least one node being pointed to the new instance. Maintain a table of addresses for each connected nodes, and share them between other nodes.
Secret key generated on build of the application? Not sure. Public Key Certificate to verify ownership would probably be the best way (read - easiest), at least for the initial connection to ensure that you're not adding a spoofed node.