setup: restrict access to generated private keys
wip: setup