No chmod, no umask. Do you create all secrets world-readable?
Apart from that, less dependencies is always better. I couldn’t see any hard reason to be bash-specific, so a reduction to POSIX /bin/sh would be even better, because then you catch all the BSDs as well, although they’d still need curl from packages/ports/pkgsrc.
It may require different mod or umask on different servers. For example, some may require user “www”, while some other may require the user itself.
It’s not possible to do that in a unique way. So, leave it to the end user.