The install key as a PEM file, install_key.pem, in the licence folder, for a machine with no TPM chip.

The file is made once, mode 0600 before any key byte is written, under a temporary name, synced to disk, and only then linked into place, so a crash mid-write never leaves a half key there. A copied disk carries this file, so on such a machine the host's machine id is what binds the licence.

The private key is read for each signature and never kept in a process, and no error carries the file's contents.

The file is staged in a fresh folder that is closed to other users before the file exists. Erlang cannot set the umask, so the folder is open for the moment between its creation and its chmod; a local user who enters it then could open the file in its own moment before its chmod. Both moments must line up, and a licence folder closed to other users (the library makes it 0700) leaves no such moment.