Support x509-encrypted PEM secrets

Using a password-protected SSH key is now possible. Set the decryption password with the -pwd command-line flag, or in the RSA_KEY_PWD environment variable.