This is a textbook race condition where restrictive permissions are applied only after a file has been created with weak permissions. Bonus: you get a script to decrypt LUKS encrypted volumes.