Apply sandboxing. The plain backend's needs writable StateDirectory and /dev/urandom for key generation. The service must stay root (the private key is root-only), but everything else is locked down. Signed-off-by: Paul Meyer <katexochen0@gmail.com>