Function load_or_create_project_key 

pub fn load_or_create_project_key(
    path: &Path,
) -> Result<SigningKey, IdentityError>

Load the project key at path, or create it (mode 0600, raw 32-byte seed: the format of ChainManager::load_or_create_key).

Unlike that function this one never “fixes” a loose file: a key that was readable by anyone may already be copied. Refused: a symlink (opened O_NOFOLLOW), a non-regular file, a file not owned by this user, group/world access to the file, a group/world-writable parent directory, a wrong size. The checks run on the open descriptor, not on the path, and a lost creation race re-loads the winner’s key.