Currently, keys.dat is created with default permissions on Linux, which often have insecure 644 permissions that are unsatisfactory for keyfiles. I don't know about OSX nor Windows, but I assume they have the same issue. The keys.dat file should be created with a 077 umask.