@lanodan which reminds me that I should make sure the service can't write to its own authorized_keys...