put nginx keys on server with permissions 0600 rather than 0400

so we can rebind (rebind still always replaces them which is slightly wasteful but we can live with that)