« 0400 » ? Only read for root. In your case it's more « 0440 » no? (read for root *and* cephkeyring)