The same slightly weird daemon I was talking about earlier expects to find another file in /etc containing a piece of secret information - namely, a token it will use to authenticate to a remote server. This token does not change in normal operation, and the most natural way to deal with it would be to provide it as part of the service configuration. (It cannot be generated at activation time, the way SSH host keys are.)
The *problem* with this is that it appears there's no way to make a file in the store not be world readable. What's the best way to deal with this situation? zw