Winrm server certgen command

Install certificate to the store, create winrm listener.
Can we prompt for a password instead? That's how it works for ssh-keygen. There's also no way to generate a blank password for the certificate.

A well known default isn't a good idea here since it basically is as secure as a blank password.