Add myproxy restart handler, remove no-longer-needed ca setup script, add separate group ownership to secrets yml