Refactor PEM code to remove need for provider

With this change, it is no longer necessary to register the
BouncyCastleProvider as a JVM-wide security provider in order to
read/write PEM files.  This eliminates the possibility that
the BC provider will be used for SSL operations where we are
not explicitly asking for it to be used (such as by Jetty,
when decrypting HTTPS requests).