added check for failed keychain access, added explicit keychain-access-groups entitlement