Grant Symmetric Key access to only 2 users

Question

I'm trying to create a symmetric key in SQL Server 2005 and restrict it to just the sa and application user accounts. All other accounts should get an error when trying to open it.

Here's how I'm creating it. I changed the names for the purposes of this question.

CREATE CERTIFICATE My_Certificate
  WITH SUBJECT = 'My Cert Subject';
GO

CREATE SYMMETRIC KEY My_Key
  WITH ALGORITHM = AES_256
  ENCRYPTION BY CERTIFICATE My_Certificate;
GO

At this point, the key can be opened by my app user even though I haven't given it permission. If I DENY the [public] group, I can't open the key even after I later GRANT it directly to the app user. I don't want to DENY each user individually because I don't know what users exist in Production. I also want any new users that get created to not have access to this key, either.

The DENY and GRANT lines I'm using are:

DENY VIEW DEFINITION ON SYMMETRIC KEY :: My_Key TO [public]
GRANT VIEW DEFINITION ON SYMMETRIC KEY :: My_Key TO [AppUser]

Answer 1

Who owns the keys? How does your app accesses the keys? Is ownership chaining playing any role by any chance? What groups and roles does AppUser belong to?

What permission does fn_my_permissions('My_Key', 'SYMMETRIC KEY') return when executed by the AppUser (right after the key is created) ?

Update: fixed typo in fn_my_permissions securable type