opendkim user will run the service, so needs to read key file