Allow acmetool to forego reading private keys

[hlandau]

This will require a few changes:

• Allow acmetool to forego validating the names of key directories in some circumstances.
• Possibly also allow acmetool to forego validating the existence of private keys when determining whether a certificate is usable.

Use cases: SELinux restrictions, HSMs, etc.