* The current implementation assumes a single global engine, and per profile private key: via the syntax `private_key: /engine:HSMPRIVATEKEY`. This is an expedient workaround as the parser treats strings not starting with `/` as relative PEM files. The magic prefix `/engine:` is meant for the profile to select its HSM key. * it should be possible to have per profile engine as well: that is indeed a bit more complicated so I would like to try to get the easier case critiqued first, and possibly merged