keys: allow clients to set key perms in key_create_or_update()