Thank you for the patch, we'll review it. If it makes sense for
managed-keys then it makes just as much sense for this.

I'm curious why you're using a non-writable working directory,
though?  That will cause more problems than just this.