There is code to validate a PEM file's permission: https://github.com/andreasschulze/signing-milter/blob/master/utils/validate_pem_permissions.c
That code is called every time, a new milter connection is handled by the milter: https://github.com/andreasschulze/signing-milter/blob/master/ctxdata/setup.c#L30
The milter should check the permissions on milter start once. That seems enougth ...
Alternativ: there could be a cronjob, doing such stuff