NewKeyDB: add readonly option