Easy fix: Run the tool as its own user, give write permission to cert & key files to that user. If you're really paranoid, run it in a jail that only has access

Easy fix: Run the tool as its own user, give write permission to cert & key files to that user. If you're really paranoid, run it in a jail that only has access to those files. No different than proper security for any other system process.