`allowKeysForGroup` is no longer available so this drops ``` security.acme.certs."example.com".allowKeysForGroup = true; ``` line. `SupplementaryGroups` should be enough for allowing access to certificates.