Enable TLS by default and add UI for client/daemon auth

Turns on TLS by default and uses public keys to authenticate access.

- This PR still may require further testing and input on the user experience.
- FSNotify support has not been added to detect changes to authorized_keys
- Implementation of proposal from #7667

@bfirsh please review and comment on whether this is missing anything needed
To bikeshed: "identity" based authentication?

The upside of "host-based" is that is the language that SSH uses and it's actually based on host names. The upside of "identity" is that a user will think – oh, it uses the `--identity` option.