If the behavior is as you've described, this wouldn't squash that behavior, but it would certainly make it less useful (in that definition of "perms in the module" has been changed to "644, no exceptions").

On the other hand, that behavior is currently broken for the single-user (masterless) case anyway, since `tar` running as any non-root user simply ignores the permissions and ownership from the tarball.  (The `root` behavior of retaining permissions and ownership is the security vulnerability being patched.)