The VPN client will no longer receive the private key material directly from the caller. Instead it will use the keystore OpenSSL ENGINE to request that keystore does private key operations on its behalf. We only pass the keystore key alias to the private key instead of the private key itself now. Change-Id: I4ea2abda5ab7dec7d7ef5f451b96fef5bc92d811