diff --git a/pkg/keystore/keystore.go b/pkg/keystore/keystore.go
index <HASH>..<HASH> 100644
--- a/pkg/keystore/keystore.go
+++ b/pkg/keystore/keystore.go
@@ -139,7 +139,7 @@ func storeTrustedKey(dir string, r io.Reader) (string, error) {
 	if err != nil {
 		return "", err
 	}
-	if err := os.MkdirAll(dir, 0700); err != nil {
+	if err := os.MkdirAll(dir, 0755); err != nil {
 		return "", err
 	}
 	entityList, err := openpgp.ReadArmoredKeyRing(bytes.NewReader(pubkeyBytes))
pkg: keystore: default to <I> for keystore

There is nothing private about our collection of public keys. Make it
world-readable by default. This makes it possible to fetch containers as
non-root users.