permissions and identity

I'm using usher with monotone.
Do I have it right?

User identities (the public keys) are kept in the monotone databases.  
Presumably every database can have different sets of user identities.  

But private keys are kept in a .monotone/keys directory, which is the 
same for all databases.

So the databases can differ as to public keys, but have to agree on 
provate keys.

Finally, the set of branches users can read and write to is kept in 
files different directry, .monotone/read-permissions and 
.monotone/write-permissions.  This even though moltiple data bases 
probably provide completely different branches.


Is there a rationale for this division of responsibilities, or did it 
just appear more or less by accident?

-- hendrik