I had a similar issue with a config file that users at one point had to "manually" adjust in vi, so breaking the habit was key. Since this is a matter of "keeping honest users honest" and not preventing bad guys from access sensitive stuff, I'd go with storable, it's what I used back in 2003 and that process is still in place today. The node that brought me to that conclusion is: