Allow usual users to download their private keys

app/policies/private_key_policy.rb

@@ -2,7 +2,9 @@
 
 class PrivateKeyPolicy < ApplicationPolicy
   def show?
-    account&.superuser? &&
+    return false if account.nil?
+
+    (account.superuser? || account == record.account) &&
       record.exist? &&
       params[:private_key_pem_secret].present?
   end

app/primitives/private_key.rb

@@ -3,6 +3,8 @@
 class PrivateKey
   attr_reader :asymmetric_key
 
+  delegate :account, to: :asymmetric_key
+
   def self.policy_class
     'PrivateKeyPolicy'
   end