Currently we specify this throughout all the ansible vars that specify input to the PKI role, but in almost all cases the permissions are defined by the `type`, if it is present. Change-Id: Iec65c9078fda14ff15151c1f7d48d35325adab12 Signed-off-by: Jonathan Rosser <jonathan.rosser@rd.bbc.co.uk>