Input from one of my colleagues:
The specification states:

8.3.2 GetSecurityKeys Method
...
"The Permission of the SecurityGroupType Object for the SecurityGroupId controls the access to the security keys for the SecurityGroupId. If the user used to call this Method does not have the Call Permission set for the related SecurityGroupType Object, the Server shall return Bad_UserAccessDenied for this Method."

and

8.4.1 SecurityGroupType definition
...
"The Permission of the SecurityGroupType Objects controls the access to
the security keys for the SecurityGroup through the Method
GetSecurityKeys."

Both sections indicate that the permission on the Node (instance of
SecurityGroupType) in the address space shall be used to evaluate
permission to call the method GetSecurityKeys.
However when setting call permission for SecurityKeyServerAccess on that
node that would also require to set call permissions for
SecurityKeyServerAdmin to be able to call methods on that object (e.g.
ForceKeyRotation).

We need a clarification on how to interpret the rolePermissions set in
the SecurityGroupDataType and if/how to apply them to the address space.