keys: consider user namespace in key_permission