Add various PKINIT-with-responder tests
Don't fail if a candidate certificate has no SANs
Rework PEM loading

* Load certificates before keys, to work around a bug in the PEM module.
* Use a better method for finding the certificate that we've loaded,
  after we've loaded it.
Include error names in these debug messages
Handle encrypted PEM files

The PEM module sets its needs-login flag when we pass it an encrypted
PEM file, and we need to be ready to give it _something_ before we
continue attempting to import any other data.
Don't save keys we can't encrypt; just delete them

If we have trouble loading a private key, don't bother hanging on to it,
just remove it.  We can always come back and try to load it again later.