When changes are made to pubring.kbx, the file is moved to pubring.kbx~ and a
new file is created with permissions based on the user's umask. This should
probably be created with the permissions of the original file, or read/write for
only the owner. Observed with GnuPG 2.1.17.

Example, with different umasks:

[user@host ~/.gnupg]$ ls -l pubring*
-rw------- 1 user group 5632 Jan 17 20:00 pubring.kbx
-rw------- 1 user group 4453 Jan 17 20:00 pubring.kbx~
[user@host ~/.gnupg]$ umask 0000
[user@host ~/.gnupg]$ gpg --edit-key anykey

<make some changes and save>

[user@host ~/.gnupg]$ ls -l pubring*
-rw-rw-rw- 1 user group 4453 Jan 17 20:01 pubring.kbx
-rw------- 1 user group 5632 Jan 17 20:00 pubring.kbx~
[user@host ~/.gnupg]$ umask 0027
[user@host ~/.gnupg]$ gpg --edit-key anykey

<make some changes and save>

[user@host ~/.gnupg]$ ls -l pubring*
-rw-r----- 1 user group 3829 Jan 17 20:02 pubring.kbx
-rw-rw-rw- 1 user group 4453 Jan 17 20:01 pubring.kbx~

Initial creation of tofu.db is also based on the user's umask, unlike other
files (such as trustdb.gpg), though write permissions are not granted to
group/other.