Switch VPN to use keystore ENGINE

The VPN client will no longer receive the private key material directly
from the caller. Instead it will use the keystore OpenSSL ENGINE to
request that keystore does private key operations on its behalf.

We only pass the keystore key alias to the private key instead of the
private key itself now.

Change-Id: I4ea2abda5ab7dec7d7ef5f451b96fef5bc92d811