certs/Makefile: Run key generation with a stricter umask (fixes a race condition)