zealot128
Rekey on renew
Regenerating key when renewing certificate should be mandatory.
There are good reasons to change encryption keys regularly. It protects against long-term key leaks and it hardens decrypting captured traffic in the future.
The fastest way was to delete the key in the renewal process, but i admit it is not very polite to delete the old key before having new certificate issued.
I would only use this as an optional argument (--rekey?) as it breaks backwards compatibility and other people's potential running setup. As you mentioned, deleting the key before having a new one, doesn't sound very great; maybe add a new private key as a Tempfile first and move it to the location on success?
