Ensure that a keystore intended for a keymanager has private keys

When using client authentication, the key store must contain private keys.  JSSE does not do a very good job at communicating this, and so this patch iterates through the key manager's keystore and logs warnings if an entry is found without a private key, and logs an error if no private key is found. 

It does not throw exceptions or terminate early, as the TLS handshake will still work fine if even if the keystore is misconfigured if the server does not use client authentication.
`password` can be `null`. Is that acceptable?