Ensure that local and remote keys have secure permissions - fixes 382

Merge after #403

Fixes #382 
Except that the real test will actually need threads, so never mind.