Make sure exported certs are not world readable

This should be the portable equivalent of UNIX' chmod 600