The mode on /var/unbound/db/root.key is influenced by the umask. If you restart unbound from a shell with umask set to 077, /var/unbound/db/root.key will be mode 0600. If the the umask is 022, the /var/unbound/db/root.key will be mode 0644.
By default, /etc/login.conf has umask set to 022. Is it more restrictive on your system? - todd
