Problem reading DKIM private keys

On wsh.webarchitects.org.uk we have a lot of lines like this in /var/log/exim4/paniclog:

2021-08-08 08:45:12.195 [2394360] 1mCeQa-00A2rA-TQ Tainted filename '/etc/exim4/dkim/wsh.webarchitects.org.uk/privkey.pem'
2021-08-08 08:45:12.195 [2394360] 1mCeQa-00A2rA-TQ unable to open file for reading: /etc/exim4/dkim/wsh.webarchitects.org.uk/privkey.pem

This is not a file ownership or permissions problem:

ls -lah /etc/exim4/dkim/wsh.webarchitects.org.uk/privkey.pem
-rw-r----- 1 Debian-exim Debian-exim 1.7K May 30 19:35 /etc/exim4/dkim/wsh.webarchitects.org.uk/privkey.pem

References:

• Debian Bullseye Exim 4.94
• Exim unable to sign DKIM keys for outgoing mail
• [exim] Tainted filename on DKIM signing in 4.94
• Exim v 4.94.2 and DKIM

@kate could you look at this when you have a chance, I think this template needs some tweaks to solve this.