The gitlab.pub file probably shouldn't be world readable, but let's start with just making it read-only and not executable.