From golang.org/x/crypto/acme/autocert, with Manager.GetPrivateKey added.