hmm... totally not digging a filesystem dependency.  Provider should not have an opinion on how users specify the private key spec for the ssl factory.  Credentials is a list of Objects for reasons like this.  Make Credentials hold a PrivateKey and build the ssl socket factory from that.

On how to make the CLI give this a private key:

We don't want external deps even in the CLI, so change it to be able to read PEM in order to harvest the private key.  Here's an implementation you can scrape methods you need from:
https://github.com/jclouds/jclouds/blob/master/core/src/main/java/org/jclouds/crypto/Pems.java#L218
https://github.com/jclouds/jclouds-labs-google/blob/master/oauth/src/main/java/org/jclouds/oauth/v2/functions/OAuthCredentialsSupplier.java
and add a nice README to the CLI when finished.