ensure root ownership of key directory