Because they need access to the key space, which in-my-not-extremely-strongly-held-opinion logically belongs to the cluster. Cluster.Fleetctl == "invoke a fleetctl command against this cluster".

Honestly this was one of the least-invasive ways I could find to implement this without refactoring the tests even more.

Alternatively I guess we could create the key in the test and pass it in to `NewNspawnCluster` and then every single invocation of `fleetctl`... but I'm not sure that's any cleaner.