Add a keystore for SSL connections

This depends on #136 and #144.

Can we make this copy _main.ks only on firstrun (or if it doesn't already exist)?

Also, these nested callbacks for startup are getting unwieldy, so we should think about improving them, but we can do that in a separate PR.