pub fn generate_key(kt: KeyType) -> Result<KeyPair, AcmeError>
A fresh private key for one issuance (never reused across renewals).