improvements to key/certificate handling

[codingchili]

• support for specifying aliases when keystore contains multiple keys.
• if no alias is configured, require that keystore contains single entry.
• support for the superior pkcs12 keystore format.
• split keystore secret from private key secret.