This way we can ensure we get the ownership and permissions right. Also explicitly restart exim on mail cert updates.