Add explicit PEM callback and switch to const char* for passphrase