Unfortunately this does not fix existing file permissions.
Spotted by Antti Harri <iku at openbsd dot fi>.
OK millert@.

long-standing annoyance that atrun's granularity is 10 minutes.
Most at jobs run with a 1 minute granularity.  Jobs submitted via
"at now" or "batch" will run immediately.  Includes a rewritten
cron(8) man page.  at(1) will be integrated more closely into
cron at a future date.
Upgrading notes:
the atrun job in root's crontab should be removed.
the /var/at/spool directory is no longer used

are *required*.