Allow anonymous role to see primary keys
A few more anon privs
Include self-signed keys
Relate auth role to anonymous so it can switch when not superuser