locksmith support for TLS+client certs

Right now if etcd on CoreOS is secured by client certificates it isn't possible to use locksmith.
This is to make it much easier to eventually swap out go-etcd, and to better confine the interface of locksmith's use of etcd