Improve PKI security & management

[mgoodness]

Right now, keys & certificates are created by a shell script and uploaded to an S3 bucket. Security of that bucket and rotation of the PKI assets are mostly left up to the user. We should provide better options, whether it's provided by the upstream CSR API or by third-party tool like Vault.

[justicel]

If this is helpful at all, I'm going to try using this option: http://apparently.me.uk/terraform-certificate-authority/