>Grab ssh private keys from autoprovisioned EC2 user’s home directory using 301 redirect to file URI (after all, we’re running as root, we can read them).

This is not a fair assumption to make. Maybe they are running a LSM like AppArmor.