don't change owner of secret files; they are read by root and then privileges are dropped