Don't run the SCT maintenance daemon or otherwise fetch SCTs as root.