setup: restrict access to generated private keys
setup: restrict access to db file and add CLI tool for running setup