`install` copies the files before setting their mode, so there could be a breif window where the secrets are readable by other users without a strict umask.