The secret key that encrypts the backups should not be world readable.

umask at the creation of the key plus migration.py-function to fix permission in existing installations.