new: handle password for PEM files