use noinst_HEADERS for hx509-private.h