Complete the mitm prevention on GCE.

I think a more secure approach would be to run this in a subshell and set `umask 077` to have group/other bits set to 0 at file creation, otherwise there's a race between file creation and `chmod` command in which an attacker could manage to open the file (assuming the `gcutil pull` would create them as group/other-readable.)