As it happens, after testing the `GetObject` permission is also required to do `HEAD` requests on a given object.
cf.: https://github.com/ncw/rclone/issues/1455