cp -ax apparently doesn’t copy filesystem capabilities… evidenced by gnome-keyring-daemon not being able to set its IPC/”do not swap” permission on the process… (fixed by reinstalling the package).