0.3.1

Changed

• The packaged systemd service can read root-managed TLS certificates, including
  Certbot's default paths, while continuing to run as the unprivileged via
  user. Inaccessible TLS files now produce a configuration error instead of an
  unhandled exception.

Fixed

• Removed the process-wide CAP_DAC_READ_SEARCH permission added to the
  packaged service in 0.3.1. TLS files must now be explicitly readable by the
  via account, preventing TLS access from also bypassing static-file
  permissions.