restructure certs/keys; add key/cert generation

I split `pem.go` into `key.go` and `cert.go`, and added methods for manipulating certificates and generating RSA keys. This provides enough functionality to generate a RSA keys, make a CA and issue a certificate with constraints. `cert_test.go` demonstrates this process.