Also export a private key, that can be imported using --allow-non-selfsigned-uid (because I was too lazy to have it sign itself, even though it'd be trivial to do.)