  We show that covert secret key expansion is possible using a public
authenticated classical channel and a quantum channel largely under control of
an adversary, which we precisely define. We also prove a converse result
showing that, under the golden standard of quantum key distribution by which
the adversary completely controls the quantum channel, no covert key generation
is possible. We propose a protocol based on pulse-position modulation and
multi-level coding that allows one to use traditional quantum key distribution
(QKD) protocols while ensuring covertness, in the sense that no statistical
test by the adversary can detect the presence of communication better than a
random guess. When run over a bosonic channel, our protocol can leverage
existing discrete-modulated continuous variable protocols. Since existing
techniques to bound Eve's information do not directly apply, we develop a new
bound that results in positive throughput for a range of channel parameters.
