Ignore PEM files; don't commit SSL secrets