Ensure keygen service is restart as part of the unbound service restart
    
    So if the admin deletes the key/pem files, a systemctl restart unbound
    still works (and generates new key/pem files)