Should we rather make it a 403 forbidden ?
The file does exist but is locked, and the user has no (valid) key.