Please support generating the end-entity certificate

[joshtriplett]

For simplicity of setup, please consider generating the end-entity certificate and private key for the challenge server itself. That would allow running pebble without having to check those files into the repository that's trying to run pebble in CI. The management interface could serve the appropriate CA public key (also generated).