Specification

The --root-key-file or PK_ROOT_KEY may be password encrypted. The agent start and bootstrap commands should check if the PEM is encrypted, and decrypt it with the --password. This means the same --password is used to decrypt (if encrypted) and to encrypt the root key.

This is important in case the root key is loaded from another PK node path. Or just generated in some other way.

Additional context

• Replace node-forge RSA Keypair With ed25519/x25519 Keypair #168 - this should still work when we move beyond RSA
• Backup Key File In Case User Forgets Keynode Passphrase #128
• Override key generation for all tests #420 - where this feature of using --root-key-file was brought in

Tasks

1. Check if PEM is encrypted
2. Use password (which has to be have been supplied already), as it is mandatory option
3. Remember if recovery code is supplied instead, then it should be ignored
4. Document in this issue the precedence of root key file, recovery code, loading from disk, and generating a new root key from scratch