Can we/should we check that the `privkey.pem` is a private key for `cert.pem`?  I think you can do this with `certtool`.