If I DENY the [public] group, I can't open the key even after I later GRANT it directly to the app user. I don't want to DENY each user individually because I don't know what users exist in ...