Allow auth.private-key-file configuration via frontend
Never return auth.private-key values