Hey everyone, we've been thinking about this at CoreOS for a little while and I wanted to get the conversation started here. This feature should simplify deploying TLS-enabled kubelets (related: #2303).

I've written an initial proposal based on the design doc that you can read at https://docs.google.com/document/d/1XPPuq9NBGNXLgZ94LvAANq8lP89nXiQFRHTzjzuE2kI/edit?usp=sharing.

cc/ @jbeda @bgrant0607 @kelseyhightower