fix: Restrict access to imported key material

Without this change imported key-material is copied as-is, which could
be extremely permissive. Since we know we are handling confidential
key-material, let's restrict the access to the imported files.