The private key in certs/ is given to group 10998 on the host, no longer 998: in the trixie image systemd's packages take ids in 100-999, and 998 is systemd-network on the test server's host. The page's help.go follows in the base-trixie commit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>