pki: make certificates only readable to group and others

even though we copy these to hosts it's not a good idea to allow them to
be overwritten by a random user

packaging/bin/pki-enroll-request.sh

@@ -37,7 +37,7 @@ sign() {
 		-utf8 \
 		${EXTRA_COMMAND} \
 		|| die "Cannot sign certificate"
-	chmod a+r "${cert}" || die "Cannot set certificate permissions"
+	chmod a+r,go-wx "${cert}" || die "Cannot set certificate permissions"
 
 	return 0
 }