Support TLS, dynamic listeners and encrypted storage

The `Certificate` type here contains a public key as well as private key. An alternative name could be `KeyPair` to denote that you contain both.