Handle PEM privkeys that aren't represented as KeyPair objects

Bouncycastle parses puppet-generated PEM private keys as KeyPair objects
with a nil public key. However, it parses PEMs generated by other tools
(like freeIPA) as PrivateKey objects. This patch fixes up our PEM
loading code to handle both cases.