simple CA setup for initial single-cluster deployment

[garlick]

We need a way for users to obtain CA-signed certs, used to submit jobs. This should be a secure operation that minimizes chances for disclosure of the CA private key. There are lots of ways that this could be set up. I wanted to open this issue to discuss possible practical ways to do it on a single cluster running Flux.

[garlick]

@grondo reminded me that we had talked about a flux imp ca sub-command that would use the IMP's setuid privilege to access the CA private key.

For example, a keygen utility could generate an unsigned cert, then pass the public part to flux imp ca sign. The IMP sets the userid in the cert based on the real uid that ran it, and returns the signed public cert to the keygen utility, which then writes it out.

The site would control the distribution of the CA private key; on a single-cluster deployment, perhaps limiting it to a login node.

This scheme would require the IMP to be installed with o+x permissions.