sympl-mail: Debian-exim user should be added to sympl group.
As is, the Debian-exim user already has access to the ssl-certs and other things, so giving it access to the config directory shouldn't be a problem now things are properly partitioned and will allow users to still configure things via SFTP.
sympl-filesystem-security will need adjusting for this also.