As of 67a5d66 this is no longer true, since acme postRun runs as root. The idea of the service is good so reword a comment a bit.
67a5d66