Tighten permissions on cryptomaterials -- opevpn never needs to write them