atomicWrite previously overwrote the entire security_patch.txt with only the three global lines, destroying the per-package [pkg] overrides supported by ConfigurationManager. Read the existing file, strip only global system/boot/vendor/all key assignments, prepend the refreshed global block, and append everything else (comments, blanks, all [pkg] sections) verbatim.