Support for encrypted private key PEMs

This could have been added to `toPrivatePem`, but I didn't want to break the interface, so I added it as a new method on private key objects.