This could be world readable, to match host public keys?  Though equally, the cacert above has restrictive permissions.